Commit e0ff126e authored Dec 16, 2019 by Jan Kara Committed by Al Viro Dec 16, 2019

pipe: Fix bogus dereference in iov_iter_alignment()

We cannot look at 'i->pipe' unless we know the iter is a pipe. Move the
ring_size load to a branch in iov_iter_alignment() where we've already
checked the iter is a pipe to avoid bogus dereference.

Reported-by: <syzbot+bea68382bae9490e7dd6@syzkaller.appspotmail.com>
Fixes: 8cefc107 ("pipe: Use head and tail pointers for the ring, not cursor and length")
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

parent e42617b8

lib/iov_iter.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -1222,11 +1222,12 @@ EXPORT_SYMBOL(iov_iter_discard);

		unsigned long iov_iter_alignment(const struct iov_iter *i)
		{
		unsigned int p_mask = i->pipe->ring_size - 1;
		unsigned long res = 0;
		size_t size = i->count;

		if (unlikely(iov_iter_is_pipe(i))) {
		unsigned int p_mask = i->pipe->ring_size - 1;

		if (size && i->iov_offset && allocated(&i->pipe->bufs[i->head & p_mask]))
		return size \| i->iov_offset;
		return size;