Commit b71dbf10 authored by Darrick J. Wong's avatar Darrick J. Wong Committed by Linus Torvalds

vfs: cap dedupe request structure size at PAGE_SIZE

Kirill A Shutemov reports that the kernel doesn't try to cap dest_count
in any way, and uses the number to allocate kernel memory.  This causes
high order allocation warnings in the kernel log if someone passes in a
big enough value.  We should clamp the allocation at PAGE_SIZE to avoid
stressing the VM.

The two existing users of the dedupe ioctl never send more than 120
requests, so we can safely clamp dest_range at PAGE_SIZE, because with
4k pages we can handle up to 127 dedupe candidates.  Given the max
extent length of 16MB, we can end up doing 2GB of IO which is plenty.

[ Note: the "offsetof()" can't overflow, because 'count' is just a
  16-bit integer.  That's not obvious in the limited context of the
  patch, so I'm noting it here because it made me go look.  - Linus ]
Reported-by: default avatar"Kirill A. Shutemov" <kirill@shutemov.name>
Signed-off-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 5297e0f0
...@@ -582,6 +582,10 @@ static int ioctl_file_dedupe_range(struct file *file, void __user *arg) ...@@ -582,6 +582,10 @@ static int ioctl_file_dedupe_range(struct file *file, void __user *arg)
} }
size = offsetof(struct file_dedupe_range __user, info[count]); size = offsetof(struct file_dedupe_range __user, info[count]);
if (size > PAGE_SIZE) {
ret = -ENOMEM;
goto out;
}
same = memdup_user(argp, size); same = memdup_user(argp, size);
if (IS_ERR(same)) { if (IS_ERR(same)) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment