All of lore.kernel.org
 help / color / mirror / Atom feed
From: Jiang Liu <liuj97@gmail.com>
To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	Nitin Gupta <ngupta@vflare.org>, Minchan Kim <minchan@kernel.org>,
	Jerome Marchand <jmarchan@redhat.com>
Cc: Yijing Wang <wangyijing@huawei.com>,
	Jiang Liu <jiang.liu@huawei.com>,
	devel@driverdev.osuosl.org, linux-kernel@vger.kernel.org
Subject: [PATCH v2 06/10] zram: avoid access beyond the zram device
Date: Wed,  5 Jun 2013 00:06:04 +0800	[thread overview]
Message-ID: <1370361968-8764-6-git-send-email-jiang.liu@huawei.com> (raw)
In-Reply-To: <1370361968-8764-1-git-send-email-jiang.liu@huawei.com>

Function valid_io_request() should verify the entire request doesn't
exceed the zram device, otherwise it will cause invalid memory access.

Signed-off-by: Jiang Liu <jiang.liu@huawei.com>
Cc: stable@vger.kernel.org
---
 drivers/staging/zram/zram_drv.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/staging/zram/zram_drv.c b/drivers/staging/zram/zram_drv.c
index 6a54bb9..1c3974f 100644
--- a/drivers/staging/zram/zram_drv.c
+++ b/drivers/staging/zram/zram_drv.c
@@ -428,6 +428,10 @@ static inline int valid_io_request(struct zram *zram, struct bio *bio)
 		return 0;
 	}
 
+	if (unlikely((bio->bi_sector << SECTOR_SHIFT) + bio->bi_size >=
+		     zram->disksize))
+		return 0;
+
 	/* I/O request is valid */
 	return 1;
 }
-- 
1.8.1.2


  parent reply	other threads:[~2013-06-04 16:09 UTC|newest]

Thread overview: 32+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2013-06-04 16:05 [PATCH v2 01/10] zram: kill unused zram_get_num_devices() Jiang Liu
2013-06-04 16:06 ` [PATCH v2 02/10] zram: avoid invalid memory access in zram_exit() Jiang Liu
2013-06-05  6:04   ` Minchan Kim
2013-06-05 15:24     ` Jiang Liu
2013-06-04 16:06 ` [PATCH v2 03/10] zram: use zram->lock to protect zram_free_page() in swap free notify path Jiang Liu
2013-06-05  6:29   ` Minchan Kim
2013-06-05 16:00     ` Jiang Liu
2013-06-05 10:26   ` Jerome Marchand
2013-06-04 16:06 ` [PATCH v2 04/10] zram: destroy all devices on error recovery path in zram_init() Jiang Liu
2013-06-05  6:40   ` Minchan Kim
2013-06-05 10:40   ` Jerome Marchand
2013-06-04 16:06 ` [PATCH v2 05/10] zram: avoid double free in function zram_bvec_write() Jiang Liu
2013-06-05  6:41   ` Minchan Kim
2013-06-07  9:35   ` Jerome Marchand
2013-06-04 16:06 ` Jiang Liu [this message]
2013-06-05  6:43   ` [PATCH v2 06/10] zram: avoid access beyond the zram device Minchan Kim
2013-06-04 16:06 ` [PATCH v2 07/10] zram: optimize memory operations with clear_page()/copy_page() Jiang Liu
2013-06-05  6:57   ` Minchan Kim
2013-06-04 16:06 ` [PATCH v2 08/10] zram: protect sysfs handler from invalid memory access Jiang Liu
2013-06-05  7:03   ` Minchan Kim
2013-06-04 16:06 ` [PATCH v2 09/10] zram: minor code cleanup Jiang Liu
2013-06-05  7:13   ` Minchan Kim
2013-06-04 16:06 ` [PATCH v2 10/10] zram: use atomic64_xxx() to replace zram_stat64_xxx() Jiang Liu
2013-06-05 12:02   ` Jerome Marchand
2013-06-05 16:21     ` Jiang Liu
2013-06-06  9:37       ` Jerome Marchand
2013-06-06 14:36         ` Jiang Liu
2013-06-06 15:07           ` Jerome Marchand
2013-06-06 15:56             ` Jiang Liu
2013-06-05  5:52 ` [PATCH v2 01/10] zram: kill unused zram_get_num_devices() Minchan Kim
2013-06-05 15:09   ` Jiang Liu
2013-06-05  9:06 ` Jerome Marchand

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1370361968-8764-6-git-send-email-jiang.liu@huawei.com \
    --to=liuj97@gmail.com \
    --cc=devel@driverdev.osuosl.org \
    --cc=gregkh@linuxfoundation.org \
    --cc=jiang.liu@huawei.com \
    --cc=jmarchan@redhat.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=minchan@kernel.org \
    --cc=ngupta@vflare.org \
    --cc=wangyijing@huawei.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.