Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f3f63c1c authored by Jens Axboe's avatar Jens Axboe
Browse files

block: limit vec count in bio_kmalloc() and bio_alloc_map_data() 



Reported-by: default avatarDan Rosenberg <drosenberg@vsecurity.com>
Cc: stable@kernel.org
Signed-off-by: default avatarJens Axboe <jaxboe@fusionio.com>
parent 9f864c80

fs/bio.c

+8 −1
Original line number Diff line number Diff line
@@ -370,6 +370,9 @@ struct bio *bio_kmalloc(gfp_t gfp_mask, int nr_iovecs) 
{

	struct bio *bio;



	if (nr_iovecs > UIO_MAXIOV)

		return NULL;



	bio = kmalloc(sizeof(struct bio) + nr_iovecs * sizeof(struct bio_vec),

		      gfp_mask);

	if (unlikely(!bio))
@@ -697,8 +700,12 @@ static void bio_free_map_data(struct bio_map_data *bmd) 
static struct bio_map_data *bio_alloc_map_data(int nr_segs, int iov_count,

					       gfp_t gfp_mask)

{

	struct bio_map_data *bmd = kmalloc(sizeof(*bmd), gfp_mask);

	struct bio_map_data *bmd;



	if (iov_count > UIO_MAXIOV)

		return NULL;



	bmd = kmalloc(sizeof(*bmd), gfp_mask);

	if (!bmd)

		return NULL;