block: limit vec count in bio_kmalloc() and bio_alloc_map_data()

commit f3f63c1c28bc861a931fac283b5bc3585efb8967 upstream.

Reported-by: Dan Rosenberg <drosenberg@vsecurity.com>
Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/fs/bio.c b/fs/bio.c
index e0c9e71cc40422db3051e09741e10d1a9e738661..4c96a60a7db2eccde29218b6ec64be2d1045261e 100644 (file)
--- a/fs/bio.c
+++ b/fs/bio.c
@@ -371,6 +371,9 @@ struct bio *bio_kmalloc(gfp_t gfp_mask, int nr_iovecs)
 {
        struct bio *bio;
 
+       if (nr_iovecs > UIO_MAXIOV)
+               return NULL;
+
        bio = kmalloc(sizeof(struct bio) + nr_iovecs * sizeof(struct bio_vec),
                      gfp_mask);
        if (unlikely(!bio))
@@ -701,8 +704,12 @@ static void bio_free_map_data(struct bio_map_data *bmd)
 static struct bio_map_data *bio_alloc_map_data(int nr_segs, int iov_count,
                                               gfp_t gfp_mask)
 {
-       struct bio_map_data *bmd = kmalloc(sizeof(*bmd), gfp_mask);
+       struct bio_map_data *bmd;
+
+       if (iov_count > UIO_MAXIOV)
+               return NULL;
 
+       bmd = kmalloc(sizeof(*bmd), gfp_mask);
        if (!bmd)
                return NULL;