ACK/cmnt: [SRU][Xenial][PATCH 1/1] more bio_map_user_iov() leak fixes
Stefan Bader
stefan.bader at canonical.com
Tue Dec 12 10:03:10 UTC 2017
On 08.12.2017 13:38, Kleber Sacilotto de Souza wrote:
> From: Al Viro <viro at zeniv.linux.org.uk>
>
> we need to take care of failure exit as well - pages already
> in bio should be dropped by analogue of bio_unmap_pages(),
> since their refcounts had been bumped only once per reference
> in bio.
>
> Cc: stable at vger.kernel.org
> Signed-off-by: Al Viro <viro at zeniv.linux.org.uk>
>
> CVE-CVE-2017-12190
> (backported from commit 2b04e8f6bbb196cab4b232af0f8d48ff2c7a8058)
> [klebers: page_cache_release() is defined as put_page(), but keep it as
> page_cache_release() for consistency with the rest of the code.]
> Signed-off-by: Kleber Sacilotto de Souza <kleber.souza at canonical.com>
Acked-by: Stefan Bader <stefan.bader at canonical.com>
> ---
Same provisional ack in case both functions are the same.
> block/bio.c | 14 +++++++++-----
> 1 file changed, 9 insertions(+), 5 deletions(-)
>
> diff --git a/block/bio.c b/block/bio.c
> index 68bbc835bacc..6750552d6b16 100644
> --- a/block/bio.c
> +++ b/block/bio.c
> @@ -1268,6 +1268,7 @@ struct bio *bio_map_user_iov(struct request_queue *q,
> int ret, offset;
> struct iov_iter i;
> struct iovec iov;
> + struct bio_vec *bvec;
>
> iov_for_each(iov, i, *iter) {
> unsigned long uaddr = (unsigned long) iov.iov_base;
> @@ -1312,7 +1313,12 @@ struct bio *bio_map_user_iov(struct request_queue *q,
> ret = get_user_pages_fast(uaddr, local_nr_pages,
> (iter->type & WRITE) != WRITE,
> &pages[cur_page]);
> - if (ret < local_nr_pages) {
> + if (unlikely(ret < local_nr_pages)) {
> + for (j = cur_page; j < page_limit; j++) {
> + if (!pages[j])
> + break;
> + put_page(pages[j]);
> + }
> ret = -EFAULT;
> goto out_unmap;
> }
> @@ -1374,10 +1380,8 @@ struct bio *bio_map_user_iov(struct request_queue *q,
> return bio;
>
> out_unmap:
> - for (j = 0; j < nr_pages; j++) {
> - if (!pages[j])
> - break;
> - page_cache_release(pages[j]);
> + bio_for_each_segment_all(bvec, bio, j) {
> + page_cache_release(bvec->bv_page);
> }
> out:
> kfree(pages);
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20171212/a95b0436/attachment.sig>
More information about the kernel-team
mailing list