2012-02-03 15:28:47

by Xi Wang

Subject: [PATCH] nilfs2: avoid overflowing segment numbers in nilfs_ioctl_clean_segments()

nsegs is read from userspace. Limit its value and avoid overflowing
nsegs * sizeof(__u64) in the subsequent call to memdup_user().

This patch complements 481fe17e973fb97aa3edf17c69557afe88d8334f.

Signed-off-by: Xi Wang <[email protected]>
Cc: Haogang Chen <[email protected]>
Cc: Andrew Morton <[email protected]>
---
fs/nilfs2/ioctl.c | 2 ++
1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/fs/nilfs2/ioctl.c b/fs/nilfs2/ioctl.c
index 8866496..2a70fce 100644
--- a/fs/nilfs2/ioctl.c
+++ b/fs/nilfs2/ioctl.c
@@ -603,6 +603,8 @@ static int nilfs_ioctl_clean_segments(struct inode *inode, struct file *filp,
nsegs = argv[4].v_nmembs;
if (argv[4].v_size != argsz[4])
goto out;
+ if (nsegs > UINT_MAX / sizeof(__u64))
+ goto out;

/*
* argv[4] points to segment numbers this ioctl cleans. We
--
1.7.5.4

2012-02-04 03:13:13

by Ryusuke Konishi

Subject: Re: [PATCH] nilfs2: avoid overflowing segment numbers in nilfs_ioctl_clean_segments()

On Fri, 3 Feb 2012 10:26:07 -0500, Xi Wang wrote:
> nsegs is read from userspace. Limit its value and avoid overflowing
> nsegs * sizeof(__u64) in the subsequent call to memdup_user().
>
> This patch complements 481fe17e973fb97aa3edf17c69557afe88d8334f.
>
> Signed-off-by: Xi Wang <[email protected]>
> Cc: Haogang Chen <[email protected]>
> Cc: Andrew Morton <[email protected]>
> ---
> fs/nilfs2/ioctl.c | 2 ++
> 1 files changed, 2 insertions(+), 0 deletions(-)

Acked-by: Ryusuke Konishi <[email protected]>


Thank you for posting this fix.

Andrew, could you send this uptream in this cycle ?

Ryusuke Konishi

> diff --git a/fs/nilfs2/ioctl.c b/fs/nilfs2/ioctl.c
> index 8866496..2a70fce 100644
> --- a/fs/nilfs2/ioctl.c
> +++ b/fs/nilfs2/ioctl.c
> @@ -603,6 +603,8 @@ static int nilfs_ioctl_clean_segments(struct inode *inode, struct file *filp,
> nsegs = argv[4].v_nmembs;
> if (argv[4].v_size != argsz[4])
> goto out;
> + if (nsegs > UINT_MAX / sizeof(__u64))
> + goto out;
>
> /*
> * argv[4] points to segment numbers this ioctl cleans. We
> --
> 1.7.5.4
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to [email protected]
> More majordomo info at http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at http://www.tux.org/lkml/

2012-02-04 04:35:45

by Andrew Morton

Subject: Re: [PATCH] nilfs2: avoid overflowing segment numbers in nilfs_ioctl_clean_segments()

On Sat, 04 Feb 2012 12:13:02 +0900 (JST) Ryusuke Konishi <[email protected]> wrote:

> On Fri, 3 Feb 2012 10:26:07 -0500, Xi Wang wrote:
> > nsegs is read from userspace. Limit its value and avoid overflowing
> > nsegs * sizeof(__u64) in the subsequent call to memdup_user().
> >
> > This patch complements 481fe17e973fb97aa3edf17c69557afe88d8334f.
> >
> > Signed-off-by: Xi Wang <[email protected]>
> > Cc: Haogang Chen <[email protected]>
> > Cc: Andrew Morton <[email protected]>
> > ---
> > fs/nilfs2/ioctl.c | 2 ++
> > 1 files changed, 2 insertions(+), 0 deletions(-)
>
> Acked-by: Ryusuke Konishi <[email protected]>
>
>
> Thank you for posting this fix.
>
> Andrew, could you send this uptream in this cycle ?

I sure can.