github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-30 01:53:29 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

netfs: Fix overrun check in netfs_extract_user_iter()

Browse Source 
Fix netfs_extract_user_iter() so that if iov_iter_extract_pages() overfills
pages[], then those pages don't get included in the iterator constructed at
the end of the function.  If there was an overfill, memory corruption has
already happened.

Fixes: 85dd2c8ff3 ("netfs: Add a function to extract a UBUF or IOVEC into a BVEC iterator")
Closes: https://sashiko.dev/#/patchset/20260427154639.180684-1-dhowells%40redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
Link: https://patch.msgid.link/20260512123404.719402-11-dhowells@redhat.com
cc: Paulo Alcantara <pc@manguebit.org>
cc: netfs@lists.linux.dev
cc: linux-fsdevel@vger.kernel.org
Signed-off-by: Christian Brauner <brauner@kernel.org>
This commit is contained in:
David Howells 2026-05-12 13:33:47 +01:00 committed by Christian Brauner
parent 0aad5704c6
commit 0ef37eef83
No known key found for this signature in database
GPG Key ID: 91C61BC06578DCA2
1 changed files with 17 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
fs/netfs/iterator.c
View File

@ -72,20 +72,23 @@ ssize_t netfs_extract_user_iter(struct iov_iter *orig, size_t orig_len,
break;
}
if (ret > count) {
pr_err("get_pages rc=%zd more than %zu\n", ret, count);
if (WARN(ret > count,
"%s: extract_pages overrun %zd > %zu bytes\n",
__func__, ret, count)) {
ret = -EIO;
break;
}
cur_npages = DIV_ROUND_UP(offset + ret, PAGE_SIZE);
if (WARN(cur_npages > max_pages - npages,
"%s: extract_pages overrun %u > %u pages\n",
__func__, npages + cur_npages, max_pages)) {
ret = -EIO;
break;
}
count -= ret;
ret += offset;
cur_npages = DIV_ROUND_UP(ret, PAGE_SIZE);
if (npages + cur_npages > max_pages) {
pr_err("Out of bvec array capacity (%u vs %u)\n",
npages + cur_npages, max_pages);
break;
}
for (i = 0; i < cur_npages; i++) {
len = ret > PAGE_SIZE ? PAGE_SIZE : ret;
@ -97,6 +100,11 @@ ssize_t netfs_extract_user_iter(struct iov_iter *orig, size_t orig_len,
npages += cur_npages;
}
/* Note: Don't try to clean up after EIO. Either we got no pages, so
* nothing to clean up, or we got a buffer overrun, memory corruption
* and can't trust the stuff in the buffer (a WARN was emitted).
*/
if (ret < 0 && (ret == -ENOMEM || npages == 0)) {
for (i = 0; i < npages; i++)
unpin_user_page(bv[i].bv_page);