[PATCH 3.12 084/142] AIO: properly check iovec sizes

[Jiri Slaby]

From: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

In Linus's tree, the iovec code has been reworked massively, but in
older kernels the AIO layer should be checking this before passing the
request on to other layers.

Many thanks to Ben Hawkes of Google Project Zero for pointing out the
issue.

Reported-by: Ben Hawkes <hawkes@xxxxxxxxxx>
Acked-by: Benjamin LaHaise <bcrl@xxxxxxxxx>
Tested-by: Willy Tarreau <w@xxxxxx>
Signed-off-by: Jiri Slaby <jslaby@xxxxxxx>
---
 fs/aio.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/fs/aio.c b/fs/aio.c
index 31a5cb74ae1f..b37e86c54a36 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -1380,11 +1380,16 @@ static ssize_t aio_setup_single_vector(struct kiocb *kiocb,
 				       unsigned long *nr_segs,
 				       struct iovec *iovec)
 {
-	if (unlikely(!access_ok(!rw, buf, kiocb->ki_nbytes)))
+	size_t len = kiocb->ki_nbytes;
+
+	if (len > MAX_RW_COUNT)
+		len = MAX_RW_COUNT;
+
+	if (unlikely(!access_ok(!rw, buf, len)))
 		return -EFAULT;
 
 	iovec->iov_base = buf;
-	iovec->iov_len = kiocb->ki_nbytes;
+	iovec->iov_len = len;
 	*nr_segs = 1;
 	return 0;
 }
-- 
2.7.1