diff options
author | Jens Axboe <jaxboe@fusionio.com> | 2010-10-29 11:46:56 -0600 |
---|---|---|
committer | Jens Axboe <jaxboe@fusionio.com> | 2010-11-10 14:40:42 +0100 |
commit | f3f63c1c28bc861a931fac283b5bc3585efb8967 (patch) | |
tree | 79c05b76488d9595bbb365b8185842357f8b3eec /fs/bio.c | |
parent | 9f864c80913467312c7b8690e41fb5ebd1b50e92 (diff) | |
download | linux-f3f63c1c28bc861a931fac283b5bc3585efb8967.tar.gz linux-f3f63c1c28bc861a931fac283b5bc3585efb8967.tar.xz |
block: limit vec count in bio_kmalloc() and bio_alloc_map_data()
Reported-by: Dan Rosenberg <drosenberg@vsecurity.com>
Cc: stable@kernel.org
Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
Diffstat (limited to 'fs/bio.c')
-rw-r--r-- | fs/bio.c | 9 |
1 files changed, 8 insertions, 1 deletions
@@ -370,6 +370,9 @@ struct bio *bio_kmalloc(gfp_t gfp_mask, int nr_iovecs) { struct bio *bio; + if (nr_iovecs > UIO_MAXIOV) + return NULL; + bio = kmalloc(sizeof(struct bio) + nr_iovecs * sizeof(struct bio_vec), gfp_mask); if (unlikely(!bio)) @@ -697,8 +700,12 @@ static void bio_free_map_data(struct bio_map_data *bmd) static struct bio_map_data *bio_alloc_map_data(int nr_segs, int iov_count, gfp_t gfp_mask) { - struct bio_map_data *bmd = kmalloc(sizeof(*bmd), gfp_mask); + struct bio_map_data *bmd; + + if (iov_count > UIO_MAXIOV) + return NULL; + bmd = kmalloc(sizeof(*bmd), gfp_mask); if (!bmd) return NULL; |