[3.19.y-ckt stable] Patch "[stable-only] AIO: properly check iovec sizes" has been added to the 3.19.y-ckt tree

[Kamal Mostafa]

This is a note to let you know that I have just added a patch titled

    [stable-only] AIO: properly check iovec sizes

to the linux-3.19.y-queue branch of the 3.19.y-ckt extended stable tree 
which can be found at:

    http://kernel.ubuntu.com/git/ubuntu/linux.git/log/?h=linux-3.19.y-queue

This patch is scheduled to be released in version 3.19.8-ckt17.

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.19.y-ckt tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Kamal

---8<------------------------------------------------------------

>From 3e9634b2a5889be34ed80468863031f297af3f38 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
Date: Fri, 19 Feb 2016 17:36:21 -0800
Subject: [stable-only] AIO: properly check iovec sizes

In Linus's tree, the iovec code has been reworked massively, but in
older kernels the AIO layer should be checking this before passing the
request on to other layers.

Many thanks to Ben Hawkes of Google Project Zero for pointing out the
issue.

Reported-by: Ben Hawkes <hawkes at google.com>
Acked-by: Benjamin LaHaise <bcrl at kvack.org>
Tested-by: Willy Tarreau <w at 1wt.eu>
Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
Cc: Moritz Muehlenhoff <jmm at inutil.org>
Signed-off-by: Luis Henriques <luis.henriques at canonical.com>
Signed-off-by: Kamal Mostafa <kamal at canonical.com>
---
 fs/aio.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/fs/aio.c b/fs/aio.c
index ebd0e9b..6a17d03 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -1390,11 +1390,16 @@ static ssize_t aio_setup_single_vector(struct kiocb *kiocb,
 				       unsigned long *nr_segs,
 				       struct iovec *iovec)
 {
-	if (unlikely(!access_ok(!rw, buf, kiocb->ki_nbytes)))
+	size_t len = kiocb->ki_nbytes;
+
+	if (len > MAX_RW_COUNT)
+		len = MAX_RW_COUNT;
+
+	if (unlikely(!access_ok(!rw, buf, len)))
 		return -EFAULT;

 	iovec->iov_base = buf;
-	iovec->iov_len = kiocb->ki_nbytes;
+	iovec->iov_len = len;
 	*nr_segs = 1;
 	return 0;
 }
--
2.7.0