tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

copy_file_range: limit size if in compat mode

If the process runs in 32-bit compat mode, copy_file_range results can be
in the in-band error range. In this case limit copy length to MAX_RW_COUNT
to prevent a signed overflow.

Reported-by: Florian Weimer <fweimer@redhat.com>
Closes: https://lore.kernel.org/all/lhuh5ynl8z5.fsf@oldenburg.str.redhat.com/
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Link: https://lore.kernel.org/20250813151107.99856-1-mszeredi@redhat.com
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Christian Brauner <brauner@kernel.org>

authored by

Miklos Szeredi and committed by
Christian Brauner f8f59a2c 15769d94

+9 -5
+9 -5
fs/read_write.c
··· 1576 1576 if (len == 0) 1577 1577 return 0; 1578 1578 1579 + /* 1580 + * Make sure return value doesn't overflow in 32bit compat mode. Also 1581 + * limit the size for all cases except when calling ->copy_file_range(). 1582 + */ 1583 + if (splice || !file_out->f_op->copy_file_range || in_compat_syscall()) 1584 + len = min_t(size_t, MAX_RW_COUNT, len); 1585 + 1579 1586 file_start_write(file_out); 1580 1587 1581 1588 /* ··· 1596 1589 len, flags); 1597 1590 } else if (!splice && file_in->f_op->remap_file_range && samesb) { 1598 1591 ret = file_in->f_op->remap_file_range(file_in, pos_in, 1599 - file_out, pos_out, 1600 - min_t(loff_t, MAX_RW_COUNT, len), 1601 - REMAP_FILE_CAN_SHORTEN); 1592 + file_out, pos_out, len, REMAP_FILE_CAN_SHORTEN); 1602 1593 /* fallback to splice */ 1603 1594 if (ret <= 0) 1604 1595 splice = true; ··· 1629 1624 * to splicing from input file, while file_start_write() is held on 1630 1625 * the output file on a different sb. 1631 1626 */ 1632 - ret = do_splice_direct(file_in, &pos_in, file_out, &pos_out, 1633 - min_t(size_t, len, MAX_RW_COUNT), 0); 1627 + ret = do_splice_direct(file_in, &pos_in, file_out, &pos_out, len, 0); 1634 1628 done: 1635 1629 if (ret > 0) { 1636 1630 fsnotify_access(file_in);