aio: sanitize the limit checking in io_submit(2) (1da92779) · Commits · 戴 / test

as it is, the logics in native io_submit(2) is "if asked for more than LONG_MAX/sizeof(pointer) iocbs to submit, don't bother with more than LONG_MAX/sizeof(pointer)" (i.e. 512M requests on 32bit and 1E requests on 64bit) while compat io_submit(2) goes with "stop after the first PAGE_SIZE/sizeof(pointer) iocbs", i.e. 1K or so. Which is * inconsistent * *way* too much in native case * possibly too little in compat one and * wrong anyway, since the natural point where we ought to stop bothering is ctx->nr_events Reviewed-by:

Christoph Hellwig <hch@lst.de> Signed-off-by:

Al Viro <viro@zeniv.linux.org.uk>

fs/aio.c

+6 −8

Original line number	Diff line number	Diff line
		@@ -1841,15 +1841,15 @@ SYSCALL_DEFINE3(io_submit, aio_context_t, ctx_id, long, nr,
		if (unlikely(nr < 0))
		return -EINVAL;

		if (unlikely(nr > LONG_MAX/sizeof(*iocbpp)))
		nr = LONG_MAX/sizeof(*iocbpp);

		ctx = lookup_ioctx(ctx_id);
		if (unlikely(!ctx)) {
		pr_debug("EINVAL: invalid context id\n");
		return -EINVAL;
		}

		if (nr > ctx->nr_events)
		nr = ctx->nr_events;

		blk_start_plug(&plug);
		for (i = 0; i < nr; i++) {
		struct iocb __user *user_iocb;
		@@ -1870,8 +1870,6 @@ SYSCALL_DEFINE3(io_submit, aio_context_t, ctx_id, long, nr,
		}

		#ifdef CONFIG_COMPAT
		#define MAX_AIO_SUBMITS (PAGE_SIZE/sizeof(struct iocb *))

		COMPAT_SYSCALL_DEFINE3(io_submit, compat_aio_context_t, ctx_id,
		int, nr, compat_uptr_t __user *, iocbpp)
		{
		@@ -1883,15 +1881,15 @@ COMPAT_SYSCALL_DEFINE3(io_submit, compat_aio_context_t, ctx_id,
		if (unlikely(nr < 0))
		return -EINVAL;

		if (nr > MAX_AIO_SUBMITS)
		nr = MAX_AIO_SUBMITS;

		ctx = lookup_ioctx(ctx_id);
		if (unlikely(!ctx)) {
		pr_debug("EINVAL: invalid context id\n");
		return -EINVAL;
		}

		if (nr > ctx->nr_events)
		nr = ctx->nr_events;

		blk_start_plug(&plug);
		for (i = 0; i < nr; i++) {
		compat_uptr_t user_iocb;

Admin message