lkml.org 
[lkml]   [2015]   [Jul]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.14 14/34] splice: Apply generic position and size checks to each write
    Date
    3.14-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Ben Hutchings <ben@decadent.org.uk>

    commit 894c6350eaad7e613ae267504014a456e00a3e2a from the 3.2-stable branch.

    We need to check the position and size of file writes against various
    limits, using generic_write_check(). This was not being done for
    the splice write path. It was fixed upstream by commit 8d0207652cbe
    ("->splice_write() via ->write_iter()") but we can't apply that.

    CVE-2014-7822

    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Vinson Lee <vlee@twopensource.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    fs/ocfs2/file.c | 8 ++++++--
    fs/splice.c | 8 ++++++--
    2 files changed, 12 insertions(+), 4 deletions(-)

    --- a/fs/ocfs2/file.c
    +++ b/fs/ocfs2/file.c
    @@ -2478,9 +2478,7 @@ static ssize_t ocfs2_file_splice_write(s
    struct address_space *mapping = out->f_mapping;
    struct inode *inode = mapping->host;
    struct splice_desc sd = {
    - .total_len = len,
    .flags = flags,
    - .pos = *ppos,
    .u.file = out,
    };

    @@ -2490,6 +2488,12 @@ static ssize_t ocfs2_file_splice_write(s
    out->f_path.dentry->d_name.len,
    out->f_path.dentry->d_name.name, len);

    + ret = generic_write_checks(out, ppos, &len, 0);
    + if (ret)
    + return ret;
    + sd.total_len = len;
    + sd.pos = *ppos;
    +
    pipe_lock(pipe);

    splice_from_pipe_begin(&sd);
    --- a/fs/splice.c
    +++ b/fs/splice.c
    @@ -1012,13 +1012,17 @@ generic_file_splice_write(struct pipe_in
    struct address_space *mapping = out->f_mapping;
    struct inode *inode = mapping->host;
    struct splice_desc sd = {
    - .total_len = len,
    .flags = flags,
    - .pos = *ppos,
    .u.file = out,
    };
    ssize_t ret;

    + ret = generic_write_checks(out, ppos, &len, S_ISBLK(inode->i_mode));
    + if (ret)
    + return ret;
    + sd.total_len = len;
    + sd.pos = *ppos;
    +
    pipe_lock(pipe);

    splice_from_pipe_begin(&sd);



    \
     
     \ /
      Last update: 2015-07-01 21:01    [W:4.125 / U:0.320 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site