Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S966428AbcCPIVf (ORCPT ); Wed, 16 Mar 2016 04:21:35 -0400 Received: from mail.kernel.org ([198.145.29.136]:60387 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S966383AbcCPIL6 (ORCPT ); Wed, 16 Mar 2016 04:11:58 -0400 From: lizf@kernel.org To: stable@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Al Viro , Zefan Li Subject: [PATCH 3.4 080/107] sg_start_req(): make sure that there's not too many elements in iovec Date: Wed, 16 Mar 2016 16:06:14 +0800 Message-Id: <1458115601-5762-80-git-send-email-lizf@kernel.org> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1458115541-5712-1-git-send-email-lizf@kernel.org> References: <1458115541-5712-1-git-send-email-lizf@kernel.org> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1242 Lines: 40 From: Al Viro 3.4.111-rc1 review patch. If anyone has any objections, please let me know. ------------------ commit 451a2886b6bf90e2fb378f7c46c655450fb96e81 upstream. unfortunately, allowing an arbitrary 16bit value means a possibility of overflow in the calculation of total number of pages in bio_map_user_iov() - we rely on there being no more than PAGE_SIZE members of sum in the first loop there. If that sum wraps around, we end up allocating too small array of pointers to pages and it's easy to overflow it in the second loop. X-Coverup: TINC (and there's no lumber cartel either) Signed-off-by: Al Viro [lizf: Backported to 3.4: s/MAX_UIOVEC/UIO_MAXIOV] Signed-off-by: Zefan Li --- drivers/scsi/sg.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c index fb119ce..ebe83f7 100644 --- a/drivers/scsi/sg.c +++ b/drivers/scsi/sg.c @@ -1687,6 +1687,9 @@ static int sg_start_req(Sg_request *srp, unsigned char *cmd) md->from_user = 0; } + if (unlikely(iov_count > UIO_MAXIOV)) + return -EINVAL; + if (iov_count) { int len, size = sizeof(struct sg_iovec) * iov_count; struct iovec *iov; -- 1.9.1