mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-06 00:39:48 +00:00
Code Issues Releases Wiki Activity
linux-stable/drivers/block
History
Xiongwei Song 16f2ef98cc floppy: Add max size check for user space request 
[ Upstream commit 545a32498c ]

We need to check the max request size that is from user space before
allocating pages. If the request size exceeds the limit, return -EINVAL.
This check can avoid the warning below from page allocator.

WARNING: CPU: 3 PID: 16525 at mm/page_alloc.c:5344 current_gfp_context include/linux/sched/mm.h:195 [inline]
WARNING: CPU: 3 PID: 16525 at mm/page_alloc.c:5344 __alloc_pages+0x45d/0x500 mm/page_alloc.c:5356
Modules linked in:
CPU: 3 PID: 16525 Comm: syz-executor.3 Not tainted 5.15.0-syzkaller #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
RIP: 0010:__alloc_pages+0x45d/0x500 mm/page_alloc.c:5344
Code: be c9 00 00 00 48 c7 c7 20 4a 97 89 c6 05 62 32 a7 0b 01 e8 74 9a 42 07 e9 6a ff ff ff 0f 0b e9 a0 fd ff ff 40 80 e5 3f eb 88 <0f> 0b e9 18 ff ff ff 4c 89 ef 44 89 e6 45 31 ed e8 1e 76 ff ff e9
RSP: 0018:ffffc90023b87850 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 1ffff92004770f0b RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000033 RDI: 0000000000010cc1
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001
R10: ffffffff81bb4686 R11: 0000000000000001 R12: ffffffff902c1960
R13: 0000000000000033 R14: 0000000000000000 R15: ffff88804cf64a30
FS:  0000000000000000(0000) GS:ffff88802cd00000(0063) knlGS:00000000f44b4b40
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 000000002c921000 CR3: 000000004f507000 CR4: 0000000000150ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 alloc_pages+0x1a7/0x300 mm/mempolicy.c:2191
 __get_free_pages+0x8/0x40 mm/page_alloc.c:5418
 raw_cmd_copyin drivers/block/floppy.c:3113 [inline]
 raw_cmd_ioctl drivers/block/floppy.c:3160 [inline]
 fd_locked_ioctl+0x12e5/0x2820 drivers/block/floppy.c:3528
 fd_ioctl drivers/block/floppy.c:3555 [inline]
 fd_compat_ioctl+0x891/0x1b60 drivers/block/floppy.c:3869
 compat_blkdev_ioctl+0x3b8/0x810 block/ioctl.c:662
 __do_compat_sys_ioctl+0x1c7/0x290 fs/ioctl.c:972
 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
 __do_fast_syscall_32+0x65/0xf0 arch/x86/entry/common.c:178
 do_fast_syscall_32+0x2f/0x70 arch/x86/entry/common.c:203
 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c

Reported-by: syzbot+23a02c7df2cf2bc93fa2@syzkaller.appspotmail.com
Link: https://lore.kernel.org/r/20211116131033.27685-1-sxwjean@me.com
Signed-off-by: Xiongwei Song <sxwjean@gmail.com>
Signed-off-by: Denis Efremov <efremov@linux.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-01-27 09:19:42 +01:00
..
aoe block: aoe: Fix kernel crash due to atomic sleep when exiting 2019-08-08 07:29:02 -06:00
drbd block: drbd: remove a stray unlock in __drbd_send_protocol() 2019-11-08 06:55:22 -07:00
mtip32xx block: mtip32xx: Remove call to memset after dma_alloc_coherent 2019-06-29 09:42:50 -06:00
paride paride/pcd: need to check if cd->disk is null in pcd_detect 2019-09-04 07:04:37 -06:00
rsxx block: rsxx: fix error return code of rsxx_pci_probe() 2021-03-17 17:03:56 +01:00
xen-blkback xen-blkback: fix compatibility bug with single page rings 2021-05-14 09:44:23 +02:00
zram zram: off by one in read_block_state() 2021-11-17 09:48:47 +01:00
amiflop.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
ataflop.c block: ataflop: fix breakage introduced at blk-mq refactoring 2021-11-17 09:48:38 +01:00
brd.c brd: check and limit max_part par 2020-02-24 08:37:02 +01:00
cryptoloop.c cryptoloop: add a deprecation warning 2021-09-12 08:56:40 +02:00
floppy.c floppy: Add max size check for user space request 2022-01-27 09:19:42 +01:00
Kconfig cryptoloop: add a deprecation warning 2021-09-12 08:56:40 +02:00
loop.c block: loop: set discard granularity and alignment for block device backed loop 2020-09-03 11:27:01 +02:00
loop.h
Makefile
nbd.c Revert "block: nbd: add sanity check for first_minor" 2021-09-16 12:56:13 +02:00
null_blk.h null_blk: format pr_* logs with pr_fmt 2019-09-16 08:38:29 -06:00
null_blk_main.c null_blk: fix passing of REQ_FUA flag in null_handle_rq 2020-09-03 11:26:55 +02:00
null_blk_zoned.c drivers/block/null_blk/main: Fix a double free in null_init. 2021-05-14 09:44:26 +02:00
pktcdvd.c pktcdvd: remove warning on attempting to register non-passthrough dev 2019-09-22 10:01:05 -06:00
ps3disk.c ps3disk: use the default segment boundary 2020-06-24 17:50:15 +02:00
ps3vram.c block/ps3vram: Use %llu to format sector_t after LBDAF removal 2019-06-13 03:17:50 -06:00
rbd.c rbd: always kick acquire on "acquired" and "released" notifications 2021-07-28 13:31:01 +02:00
rbd_types.h rbd: support for object-map and fast-diff 2019-07-08 14:01:45 +02:00
skd_main.c Linux 5.2-rc6 2019-07-01 08:16:08 -06:00
skd_s1120.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 497 2019-06-19 17:09:53 +02:00
sunvdc.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
swim.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
swim3.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
swim_asm.S treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
sx8.c
umem.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 349 2019-06-05 17:37:08 +02:00
umem.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 348 2019-06-05 17:37:08 +02:00
virtio_blk.c virtio-blk: Fix memory leak among suspend/resume procedure 2021-07-20 16:10:48 +02:00
xen-blkfront.c xen/blkfront: harden blkfront against event channel storms 2021-12-22 09:29:40 +01:00
xsysace.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
z2ram.c