Permalink
Browse files

splice: Apply generic position and size checks to each write

We need to check the position and size of file writes against various
limits, using generic_write_check().  This was not being done for
the splice write path.  It was fixed upstream by commit 8d0207652cbe
("->splice_write() via ->write_iter()") but we can't apply that.

CVE-2014-7822

Change-Id: I439d0c0c1803b1bf0f0971dc1418529dd6929c41
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
  • Loading branch information...
bwhacks authored and andi34 committed Jan 29, 2015
1 parent ba426e6 commit 43ce0f0a48efb16d3fa641434d8230ff07e30ab2
Showing with 12 additions and 4 deletions.
  1. +6 −2 fs/ocfs2/file.c
  2. +6 −2 fs/splice.c
View
@@ -2428,9 +2428,7 @@ static ssize_t ocfs2_file_splice_write(struct pipe_inode_info *pipe,
struct address_space *mapping = out->f_mapping;
struct inode *inode = mapping->host;
struct splice_desc sd = {
.total_len = len,
.flags = flags,
.pos = *ppos,
.u.file = out,
};
@@ -2440,6 +2438,12 @@ static ssize_t ocfs2_file_splice_write(struct pipe_inode_info *pipe,
out->f_path.dentry->d_name.len,
out->f_path.dentry->d_name.name, len);
ret = generic_write_checks(out, ppos, &len, 0);
if (ret)
return ret;
sd.total_len = len;
sd.pos = *ppos;
if (pipe->inode)
mutex_lock_nested(&pipe->inode->i_mutex, I_MUTEX_PARENT);
View
@@ -995,13 +995,17 @@ generic_file_splice_write(struct pipe_inode_info *pipe, struct file *out,
struct address_space *mapping = out->f_mapping;
struct inode *inode = mapping->host;
struct splice_desc sd = {
.total_len = len,
.flags = flags,
.pos = *ppos,
.u.file = out,
};
ssize_t ret;
ret = generic_write_checks(out, ppos, &len, S_ISBLK(inode->i_mode));
if (ret)
return ret;
sd.total_len = len;
sd.pos = *ppos;
pipe_lock(pipe);
splice_from_pipe_begin(&sd);

0 comments on commit 43ce0f0

Please sign in to comment.