diff options
| author | Thadeu Lima de Souza Cascardo <[email protected]> | 2021-05-05 12:47:06 +0000 |
|---|---|---|
| committer | Jens Axboe <[email protected]> | 2021-05-05 21:17:35 +0000 |
| commit | d1f82808877bb10d3deee7cf3374a4eb3fb582db (patch) | |
| tree | 7fd2853c3824a097c0c67b3f28255b3467d5741a /drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c | |
| parent | io_uring: Fix memory leak in io_sqe_buffers_register() (diff) | |
| download | kernel-d1f82808877bb10d3deee7cf3374a4eb3fb582db.tar.gz kernel-d1f82808877bb10d3deee7cf3374a4eb3fb582db.zip | |
io_uring: truncate lengths larger than MAX_RW_COUNT on provide buffers
Read and write operations are capped to MAX_RW_COUNT. Some read ops rely on
that limit, and that is not guaranteed by the IORING_OP_PROVIDE_BUFFERS.
Truncate those lengths when doing io_add_buffers, so buffer addresses still
use the uncapped length.
Also, take the chance and change struct io_buffer len member to __u32, so
it matches struct io_provide_buffer len member.
This fixes CVE-2021-3491, also reported as ZDI-CAN-13546.
Fixes: ddf0322db79c ("io_uring: add IORING_OP_PROVIDE_BUFFERS")
Reported-by: Billy Jheng Bing-Jhong (@st424204)
Signed-off-by: Thadeu Lima de Souza Cascardo <[email protected]>
Signed-off-by: Jens Axboe <[email protected]>
Diffstat (limited to 'drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c')
0 files changed, 0 insertions, 0 deletions