Messages in this thread | | | From | David Laight <> | Subject | RE: [PATCH v3 1/4] fs, net: Standardize on file_receive helper to move fds across processes | Date | Mon, 15 Jun 2020 08:27:24 +0000 |
| |
From: Christian Brauner > Sent: 12 June 2020 19:28 ... > > > if (size < 32) > > > return -EINVAL; > > > if (size > PAGE_SIZE) > > > return -E2BIG; > > > > (Tanget: what was the reason for copy_struct_from_user() not including > > the min/max check? I have a memory of Al objecting to having an > > "internal" limit?) > > Al didn't want the PAGE_SIZE limit in there because there's nothing > inherently wrong with copying insane amounts of memory.
The problem is really allowing a user process to allocate unbounded blocks of memory, not the copy itself.
The limit for IOW() etc is 16k - not a problem. If a 32bit size is set to just under 4GB so you really want to allocate 4GB of memory then find the request is garbage. Seems like a nice DoS attack. A 64bit size can be worse.
Potentially the limit should be in memdup_user() itself. And possibly an extra parameter giving a per-call lower? limit.
David
- Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK Registration No: 1397386 (Wales)
| |