From: Al Viro <viro@ZenIV.linux.org.uk>
To: linux-fsdevel@vger.kernel.org
Cc: Christoph Hellwig <hch@lst.de>
Subject: [PATCH v2 6/6] aio: sanitize the limit checking in io_submit(2)
Date: Mon, 28 May 2018 18:57:07 +0100 [thread overview]
Message-ID: <20180528175707.10926-6-viro@ZenIV.linux.org.uk> (raw)
In-Reply-To: <20180528175707.10926-1-viro@ZenIV.linux.org.uk>
From: Al Viro <viro@zeniv.linux.org.uk>
as it is, the logics in native io_submit(2) is "if asked for
more than LONG_MAX/sizeof(pointer) iocbs to submit, don't
bother with more than LONG_MAX/sizeof(pointer)" (i.e.
512M requests on 32bit and 1E requests on 64bit) while
compat io_submit(2) goes with "stop after the first
PAGE_SIZE/sizeof(pointer) iocbs", i.e. 1K or so. Which is
* inconsistent
* *way* too much in native case
* possibly too little in compat one
and
* wrong anyway, since the natural point where we
ought to stop bothering is ctx->nr_events
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---
fs/aio.c | 11 +++--------
1 file changed, 3 insertions(+), 8 deletions(-)
diff --git a/fs/aio.c b/fs/aio.c
index f67b0847ecac..aa4071c98335 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -1844,15 +1844,15 @@ SYSCALL_DEFINE3(io_submit, aio_context_t, ctx_id, long, nr,
if (unlikely(nr < 0))
return -EINVAL;
- if (unlikely(nr > LONG_MAX/sizeof(*iocbpp)))
- nr = LONG_MAX/sizeof(*iocbpp);
-
ctx = lookup_ioctx(ctx_id);
if (unlikely(!ctx)) {
pr_debug("EINVAL: invalid context id\n");
return -EINVAL;
}
+ if (nr > ctx->nr_events)
+ nr = ctx->nr_events;
+
blk_start_plug(&plug);
for (i = 0; i < nr; i++) {
struct iocb __user *user_iocb;
@@ -1873,8 +1873,6 @@ SYSCALL_DEFINE3(io_submit, aio_context_t, ctx_id, long, nr,
}
#ifdef CONFIG_COMPAT
-#define MAX_AIO_SUBMITS (PAGE_SIZE/sizeof(struct iocb *))
-
COMPAT_SYSCALL_DEFINE3(io_submit, compat_aio_context_t, ctx_id,
int, nr, compat_uptr_t __user *, iocbpp)
{
@@ -1886,9 +1884,6 @@ COMPAT_SYSCALL_DEFINE3(io_submit, compat_aio_context_t, ctx_id,
if (unlikely(nr < 0))
return -EINVAL;
- if (nr > MAX_AIO_SUBMITS)
- nr = MAX_AIO_SUBMITS;
-
ctx = lookup_ioctx(ctx_id);
if (unlikely(!ctx)) {
pr_debug("EINVAL: invalid context id\n");
--
2.11.0
next prev parent reply other threads:[~2018-05-28 17:57 UTC|newest]
Thread overview: 72+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-05-23 19:19 aio poll and a new in-kernel poll API V13 Christoph Hellwig
2018-05-23 19:19 ` [PATCH 01/33] fix io_destroy()/aio_complete() race Christoph Hellwig
2018-05-23 19:19 ` [PATCH 02/33] uapi: turn __poll_t sparse checkin on by default Christoph Hellwig
2018-05-23 19:19 ` [PATCH 03/33] fs: unexport poll_schedule_timeout Christoph Hellwig
2018-05-23 19:19 ` [PATCH 04/33] fs: cleanup do_pollfd Christoph Hellwig
2018-05-23 19:19 ` [PATCH 05/33] fs: update documentation to mention __poll_t and match the code Christoph Hellwig
2018-05-23 19:19 ` [PATCH 06/33] fs: add new vfs_poll and file_can_poll helpers Christoph Hellwig
2018-05-23 19:19 ` [PATCH 07/33] fs: introduce new ->get_poll_head and ->poll_mask methods Christoph Hellwig
2018-05-23 19:19 ` [PATCH 08/33] aio: simplify KIOCB_KEY handling Christoph Hellwig
2018-05-23 19:19 ` [PATCH 09/33] aio: simplify cancellation Christoph Hellwig
2018-05-23 19:19 ` [PATCH 10/33] aio: implement IOCB_CMD_POLL Christoph Hellwig
2018-05-23 19:20 ` [PATCH 11/33] aio: try to complete poll iocbs without context switch Christoph Hellwig
2018-05-23 19:20 ` [PATCH 12/33] net: refactor socket_poll Christoph Hellwig
2018-05-23 19:20 ` [PATCH 13/33] net: add support for ->poll_mask in proto_ops Christoph Hellwig
2018-05-23 19:20 ` [PATCH 14/33] net: remove sock_no_poll Christoph Hellwig
2018-05-23 19:20 ` [PATCH 15/33] net/tcp: convert to ->poll_mask Christoph Hellwig
2018-05-23 19:20 ` [PATCH 16/33] net/unix: " Christoph Hellwig
2018-05-23 19:20 ` [PATCH 17/33] net: convert datagram_poll users tp ->poll_mask Christoph Hellwig
2018-05-23 19:20 ` [PATCH 18/33] net/dccp: convert to ->poll_mask Christoph Hellwig
2018-05-23 19:20 ` [PATCH 19/33] net/atm: " Christoph Hellwig
2018-05-23 19:20 ` [PATCH 20/33] net/vmw_vsock: " Christoph Hellwig
2018-05-23 19:20 ` [PATCH 21/33] net/tipc: " Christoph Hellwig
2018-05-23 19:20 ` [PATCH 22/33] net/sctp: " Christoph Hellwig
2018-05-23 19:20 ` [PATCH 23/33] net/bluetooth: " Christoph Hellwig
2018-05-23 19:20 ` [PATCH 24/33] net/caif: " Christoph Hellwig
2018-05-23 19:20 ` [PATCH 25/33] net/nfc: " Christoph Hellwig
2018-05-23 19:20 ` [PATCH 26/33] net/phonet: " Christoph Hellwig
2018-05-23 19:20 ` [PATCH 27/33] net/iucv: " Christoph Hellwig
2018-05-23 19:20 ` [PATCH 28/33] net/rxrpc: " Christoph Hellwig
2018-05-23 19:20 ` [PATCH 29/33] crypto: af_alg: " Christoph Hellwig
2018-05-23 19:20 ` [PATCH 30/33] pipe: " Christoph Hellwig
2018-05-23 19:20 ` [PATCH 31/33] eventfd: switch " Christoph Hellwig
2018-05-23 19:20 ` [PATCH 32/33] timerfd: convert " Christoph Hellwig
2018-05-23 19:20 ` [PATCH 33/33] random: " Christoph Hellwig
2018-05-26 0:11 ` aio poll and a new in-kernel poll API V13 Al Viro
2018-05-26 7:09 ` Al Viro
2018-05-26 7:23 ` Christoph Hellwig
2018-05-27 22:27 ` Al Viro
2018-05-27 22:28 ` [PATCH 1/4] aio: all callers of aio_{read,write,fsync,poll} treat 0 and -EIOCBQUEUED the same way Al Viro
2018-05-27 22:28 ` [PATCH 2/4] aio_read_events_ring(): make a bit more readable Al Viro
2018-05-27 22:28 ` [PATCH 3/4] aio: shift copyin of iocb into io_submit_one() Al Viro
2018-05-28 5:16 ` Christoph Hellwig
2018-05-27 22:28 ` [PATCH 4/4] aio: fold do_io_submit() into callers Al Viro
2018-05-27 23:14 ` Al Viro
2018-05-28 5:24 ` Christoph Hellwig
2018-05-28 5:15 ` [PATCH 1/4] aio: all callers of aio_{read,write,fsync,poll} treat 0 and -EIOCBQUEUED the same way Christoph Hellwig
2018-05-28 14:04 ` Al Viro
2018-05-28 17:54 ` Al Viro
2018-05-28 17:57 ` [PATCH v2 1/6] aio: take list removal to (some) callers of aio_complete() Al Viro
2018-05-28 17:57 ` [PATCH v2 2/6] aio: all callers of aio_{read,write,fsync,poll} treat 0 and -EIOCBQUEUED the same way Al Viro
2018-05-29 6:08 ` Christoph Hellwig
2018-05-28 17:57 ` [PATCH v2 3/6] aio_read_events_ring(): make a bit more readable Al Viro
2018-05-28 17:57 ` [PATCH v2 4/6] aio: shift copyin of iocb into io_submit_one() Al Viro
2018-05-28 17:57 ` [PATCH v2 5/6] aio: fold do_io_submit() into callers Al Viro
2018-05-29 6:10 ` Christoph Hellwig
2018-05-28 17:57 ` Al Viro [this message]
2018-05-29 6:10 ` [PATCH v2 6/6] aio: sanitize the limit checking in io_submit(2) Christoph Hellwig
2018-05-29 6:08 ` [PATCH v2 1/6] aio: take list removal to (some) callers of aio_complete() Christoph Hellwig
2018-05-28 22:20 ` [PATCH 1/4] vmsplice: lift import_iovec() into do_vmsplice() Al Viro
2018-05-28 22:20 ` [PATCH 2/4] vmsplice(): lift importing iovec into vmsplice(2) and compat counterpart Al Viro
2018-05-28 22:20 ` [PATCH 3/4] signalfd: lift sigmask copyin and size checks to callers of do_signalfd4() Al Viro
2018-05-28 22:20 ` [PATCH 4/4] orangefs: simplify compat ioctl handling Al Viro
2018-05-31 11:11 ` kbuild test robot
2018-05-31 20:54 ` Mike Marshall
2018-05-31 21:03 ` Al Viro
2018-06-01 21:13 ` Mike Marshall
2018-06-06 22:57 ` [1/4] vmsplice: lift import_iovec() into do_vmsplice() Andrei Vagin
2018-06-07 17:56 ` Andrei Vagin
2018-06-11 20:14 ` Cyrill Gorcunov
2018-06-11 20:16 ` Al Viro
2018-06-11 20:18 ` Cyrill Gorcunov
2018-06-14 22:22 ` Andrey Vagin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180528175707.10926-6-viro@ZenIV.linux.org.uk \
--to=viro@zeniv.linux.org.uk \
--cc=hch@lst.de \
--cc=linux-fsdevel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).