Re: int overflow in io_getevents

[Jiri Slaby]

Hi,

what's the status of this? I have just hit it now and don't see it merged.

On 01/07/2016, 05:27 PM, Dmitry Vyukov wrote:
> On Thu, Jan 7, 2016 at 4:52 PM, Benjamin LaHaise <bcrl@xxxxxxxxx> wrote:
>> On Thu, Jan 07, 2016 at 04:37:43PM +0100, Dmitry Vyukov wrote:
>>> pass ts to the function
>>
>> Yeah, I should have had my morning coffee before hitting send.  Updated
>> below, and hopefully final.  Checked with a test program to confirm that
>> the huge value of seconds in timespec correctly waits, and that negative
>> or other invalid values fail with EINVAL (download from
>> http://www.kvack.org/~bcrl/aio-io_getevents-timespec.c ).
>>
>>                 -ben
>> --
>> "Thought is the essence of where you are now."
> 
> 
> Acked-by: Dmitry Vyukov <dvyukov@xxxxxxxxxx>
> 
> Thanks!
> 
>> commit 49b78150bc5762c58cfb8b19a859c354cf1a71ac
>> Author: Benjamin LaHaise <bcrl@xxxxxxxxx>
>> Date:   Thu Jan 7 10:37:58 2016 -0500
>>
>>     aio: handle integer overflow in io_getevents() timespec usage
>>
>>     Dmitry Vyukov reported an integer overflow in io_getevents() when
>>     running a fuzzer.  Upon investigation, the triggers appears to be that
>>     an invalid value for the tv_sec or tv_nsec was passed in which is not
>>     handled by timespec_to_ktime().  This patch fixes that by making
>>     io_getevents() return -EINVAL when timespec_valid() checks fail.  We
>>     use timespec_valid() instead of timespec_valid_strict() to avoid issues
>>     caused by userspace not knowing the cutoff for KTIME_SEC_MAX.
>>
>>     Reported-by: Dmitry Vyukov <dvyukov@xxxxxxxxxx>
>>     Signed-off-by: Benjamin LaHaise <bcrl@xxxxxxxxx>
>>
>> diff --git a/fs/aio.c b/fs/aio.c
>> index 155f842..e0d5398 100644
>> --- a/fs/aio.c
>> +++ b/fs/aio.c
>> @@ -1269,6 +1269,8 @@ static long read_events(struct kioctx *ctx, long min_nr, long nr,
>>
>>                 if (unlikely(copy_from_user(&ts, timeout, sizeof(ts))))
>>                         return -EFAULT;
>> +               if (!timespec_valid(&ts))
>> +                       return -EINVAL;
>>
>>                 until = timespec_to_ktime(ts);


-- 
js
suse labs