Message ID | c6f35a86fe9ae6aa33b2fd3983b4023c2f4f9c13.1726250071.git.trond.myklebust@hammerspace.com (mailing list archive) |
---|---|
State | New |
Headers | show |
Series | filemap: Fix bounds checking in filemap_read() | expand |
On Fri, Sep 13, 2024 at 01:57:04PM -0400, trondmy@kernel.org wrote: > If the caller supplies an iocb->ki_pos value that is close to the > filesystem upper limit, and an iterator with a count that causes us to > overflow that limit, then filemap_read() enters an infinite loop. Are we guaranteed that ki_pos lies in the range [0..s_maxbytes)? I'm not too familiar with the upper paths of the VFS and what guarantees we can depend on. If we are guaranteed that, could somebody document it (and indeed create kernel-doc for struct kiocb)? > > - iov_iter_truncate(iter, inode->i_sb->s_maxbytes); > + iov_iter_truncate(iter, inode->i_sb->s_maxbytes - iocb->ki_pos); > folio_batch_init(&fbatch); > > do { > -- > 2.46.0 >
On Fri, Sep 13, 2024 at 07:21:54PM +0100, Matthew Wilcox wrote: > On Fri, Sep 13, 2024 at 01:57:04PM -0400, trondmy@kernel.org wrote: > > If the caller supplies an iocb->ki_pos value that is close to the > > filesystem upper limit, and an iterator with a count that causes us to > > overflow that limit, then filemap_read() enters an infinite loop. > > Are we guaranteed that ki_pos lies in the range [0..s_maxbytes)? > I'm not too familiar with the upper paths of the VFS and what guarantees > we can depend on. If we are guaranteed that, could somebody document > it (and indeed create kernel-doc for struct kiocb)? filemap_read() checks this itself before doing anything else: if (unlikely(iocb->ki_pos >= inode->i_sb->s_maxbytes)) return 0; i.e. there is no guarantee provided by the upper layers, it's first checked right here in any buffered read path... -Dave.
diff --git a/mm/filemap.c b/mm/filemap.c index d62150418b91..c69227ccdabb 100644 --- a/mm/filemap.c +++ b/mm/filemap.c @@ -2605,7 +2605,7 @@ ssize_t filemap_read(struct kiocb *iocb, struct iov_iter *iter, if (unlikely(!iov_iter_count(iter))) return 0; - iov_iter_truncate(iter, inode->i_sb->s_maxbytes); + iov_iter_truncate(iter, inode->i_sb->s_maxbytes - iocb->ki_pos); folio_batch_init(&fbatch); do {