bugfix of access a invalid addr
diff mbox

Message ID 1455703365-21406-1-git-send-email-chenjie6@huawei.com
State New
Headers show

Commit Message

chenjie6@huawei.com Feb. 17, 2016, 10:02 a.m. UTC
From: chenjie <chenjie6@huawei.com>

when we run fs_fsbase_t, some testcase like 
write05 failed 

write05     0  TINFO  :  Enter Block 1: test with bad fd
write05     1  TPASS  :  received EBADF as expected.
write05     0  TINFO  :  Exit Block 1
write05     0  TINFO  :  Enter Block 2: test with a bad address
write05     2  TFAIL  :  write() on an invalid buffer succeeded,
			 but should have failed

Cc: <stable@vger.kernel.org>
Signed-off-by: chenjie <chenjie6@huawei.com>

---
 fs/dax.c | 5 +++++
 1 file changed, 5 insertions(+)

Comments

Ross Zwisler Feb. 18, 2016, 10:35 p.m. UTC | #1
On Wed, Feb 17, 2016 at 3:02 AM,  <chenjie6@huawei.com> wrote:
> From: chenjie <chenjie6@huawei.com>
>
> when we run fs_fsbase_t, some testcase like
> write05 failed
>
> write05     0  TINFO  :  Enter Block 1: test with bad fd
> write05     1  TPASS  :  received EBADF as expected.
> write05     0  TINFO  :  Exit Block 1
> write05     0  TINFO  :  Enter Block 2: test with a bad address
> write05     2  TFAIL  :  write() on an invalid buffer succeeded,
>                          but should have failed

I'm not sure what fs_fsbase_t is, but when testing by hand I do
correctly see an error when I give a bogus user address to dax_io().
Here's the check that fails:

                 if (iov_iter_rw(iter) == WRITE) {
                         len = copy_from_iter_pmem(dax.addr, max - pos, iter);
                         need_wmb = true;
                 } else if (!hole)
                         len = copy_to_iter((void __force *) dax.addr,
max - pos,
                                         iter);
                 else
                         len = iov_iter_zero(max - pos, iter);

                 if (!len) {
                         rc = -EFAULT;
                         break;
                 }

This last if(!len) check fails, and we return -EFAULT.

Can you share a small test program to that reproduces incorrect behavior?

>
> Cc: <stable@vger.kernel.org>
> Signed-off-by: chenjie <chenjie6@huawei.com>
>
> ---
>  fs/dax.c | 5 +++++
>  1 file changed, 5 insertions(+)
>
> diff --git a/fs/dax.c b/fs/dax.c
> index fc2e314..e1b1ff6 100644
> --- a/fs/dax.c
> +++ b/fs/dax.c
> @@ -214,6 +214,11 @@ static ssize_t dax_io(struct inode *inode, struct iov_iter *iter,
>                         max = min(pos + size, end);
>                 }
>
> +               if (unlikely(iov_iter_fault_in_readable(iter, max - pos))) {
> +                       retval = -EFAULT;

This doesn't compile...
s/retval/rc/
--
To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch
diff mbox

diff --git a/fs/dax.c b/fs/dax.c
index fc2e314..e1b1ff6 100644
--- a/fs/dax.c
+++ b/fs/dax.c
@@ -214,6 +214,11 @@  static ssize_t dax_io(struct inode *inode, struct iov_iter *iter,
 			max = min(pos + size, end);
 		}
 
+		if (unlikely(iov_iter_fault_in_readable(iter, max - pos))) {
+			retval = -EFAULT;
+			break;
+		}
+
 		if (iov_iter_rw(iter) == WRITE) {
 			len = copy_from_iter_pmem(dax.addr, max - pos, iter);
 			need_wmb = true;