Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1da92779 authored by Al Viro's avatar Al Viro
Browse files

aio: sanitize the limit checking in io_submit(2) 



as it is, the logics in native io_submit(2) is "if asked for
more than LONG_MAX/sizeof(pointer) iocbs to submit, don't
bother with more than LONG_MAX/sizeof(pointer)" (i.e.
512M requests on 32bit and 1E requests on 64bit) while
compat io_submit(2) goes with "stop after the first
PAGE_SIZE/sizeof(pointer) iocbs", i.e. 1K or so.  Which is
	* inconsistent
	* *way* too much in native case
	* possibly too little in compat one
and
	* wrong anyway, since the natural point where we
ought to stop bothering is ctx->nr_events

Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent 67ba049f

fs/aio.c

+6 −8
Original line number Diff line number Diff line
@@ -1841,15 +1841,15 @@ SYSCALL_DEFINE3(io_submit, aio_context_t, ctx_id, long, nr, 
	if (unlikely(nr < 0))

		return -EINVAL;



	if (unlikely(nr > LONG_MAX/sizeof(*iocbpp)))

		nr = LONG_MAX/sizeof(*iocbpp);



	ctx = lookup_ioctx(ctx_id);

	if (unlikely(!ctx)) {

		pr_debug("EINVAL: invalid context id\n");

		return -EINVAL;

	}



	if (nr > ctx->nr_events)

		nr = ctx->nr_events;



	blk_start_plug(&plug);

	for (i = 0; i < nr; i++) {

		struct iocb __user *user_iocb;
@@ -1870,8 +1870,6 @@ SYSCALL_DEFINE3(io_submit, aio_context_t, ctx_id, long, nr, 
}



#ifdef CONFIG_COMPAT

#define MAX_AIO_SUBMITS 	(PAGE_SIZE/sizeof(struct iocb *))



COMPAT_SYSCALL_DEFINE3(io_submit, compat_aio_context_t, ctx_id,

		       int, nr, compat_uptr_t __user *, iocbpp)

{
@@ -1883,15 +1881,15 @@ COMPAT_SYSCALL_DEFINE3(io_submit, compat_aio_context_t, ctx_id, 
	if (unlikely(nr < 0))

		return -EINVAL;



	if (nr > MAX_AIO_SUBMITS)

		nr = MAX_AIO_SUBMITS;



	ctx = lookup_ioctx(ctx_id);

	if (unlikely(!ctx)) {

		pr_debug("EINVAL: invalid context id\n");

		return -EINVAL;

	}



	if (nr > ctx->nr_events)

		nr = ctx->nr_events;



	blk_start_plug(&plug);

	for (i = 0; i < nr; i++) {

		compat_uptr_t user_iocb;