summaryrefslogtreecommitdiff
path: root/MAINTAINERS
diff options
context:
space:
mode:
authorThadeu Lima de Souza Cascardo <cascardo@canonical.com>2021-05-05 09:47:06 -0300
committerJens Axboe <axboe@kernel.dk>2021-05-05 15:17:35 -0600
commitd1f82808877bb10d3deee7cf3374a4eb3fb582db (patch)
tree7fd2853c3824a097c0c67b3f28255b3467d5741a /MAINTAINERS
parentbb6659cc0ad3c2afc3801b708b19c4c67e55ddf2 (diff)
io_uring: truncate lengths larger than MAX_RW_COUNT on provide buffers
Read and write operations are capped to MAX_RW_COUNT. Some read ops rely on that limit, and that is not guaranteed by the IORING_OP_PROVIDE_BUFFERS. Truncate those lengths when doing io_add_buffers, so buffer addresses still use the uncapped length. Also, take the chance and change struct io_buffer len member to __u32, so it matches struct io_provide_buffer len member. This fixes CVE-2021-3491, also reported as ZDI-CAN-13546. Fixes: ddf0322db79c ("io_uring: add IORING_OP_PROVIDE_BUFFERS") Reported-by: Billy Jheng Bing-Jhong (@st424204) Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'MAINTAINERS')
0 files changed, 0 insertions, 0 deletions