AIO: properly check iovec sizes

In Linus's tree, the iovec code has been reworked massively, but in
older kernels the AIO layer should be checking this before passing the
request on to other layers.

Many thanks to Ben Hawkes of Google Project Zero for pointing out the
issue.

Reported-by: Ben Hawkes <hawkes@google.com>
Acked-by: Benjamin LaHaise <bcrl@kvack.org>
Tested-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Moritz Muehlenhoff <jmm@inutil.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>

diff --git a/fs/aio.c b/fs/aio.c
index a6f86dae34becdfd6a74a1781d14efa4db25e86f..7aaa4164bba59281d7f5541151c227cafba82acc 100644 (file)
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -1378,11 +1378,16 @@ static ssize_t aio_setup_single_vector(struct kiocb *kiocb,
                                       unsigned long *nr_segs,
                                       struct iovec *iovec)
 {
-       if (unlikely(!access_ok(!rw, buf, kiocb->ki_nbytes)))
+       size_t len = kiocb->ki_nbytes;
+
+       if (len > MAX_RW_COUNT)
+               len = MAX_RW_COUNT;
+
+       if (unlikely(!access_ok(!rw, buf, len)))
                return -EFAULT;
 
        iovec->iov_base = buf;
-       iovec->iov_len = kiocb->ki_nbytes;
+       iovec->iov_len = len;
        *nr_segs = 1;
        return 0;
 }