linux-kernel - [PATCH 1/3] f2fs: avoid memory allocation failure due to a long length

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20160717062427.56718-1-jaegeuk@kernel.org>
Date:	Sat, 16 Jul 2016 23:24:25 -0700
From:	Jaegeuk Kim <jaegeuk@...nel.org>
To:	linux-kernel@...r.kernel.org, linux-fsdevel@...r.kernel.org,
	linux-f2fs-devel@...ts.sourceforge.net
Cc:	Jaegeuk Kim <jaegeuk@...nel.org>
Subject: [PATCH 1/3] f2fs: avoid memory allocation failure due to a long length

We need to avoid ENOMEM due to unexpected long length.

Signed-off-by: Jaegeuk Kim <jaegeuk@...nel.org>
---
 fs/f2fs/file.c | 46 ++++++++++++++++++++++++++++------------------
 1 file changed, 28 insertions(+), 18 deletions(-)

diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index 17b3059..3573b07 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -1039,33 +1039,43 @@ static int __clone_blkaddrs(struct inode *src_inode, struct inode *dst_inode,
 
 static int __exchange_data_block(struct inode *src_inode,
 			struct inode *dst_inode, pgoff_t src, pgoff_t dst,
-			int len, bool full)
+			pgoff_t len, bool full)
 {
 	block_t *src_blkaddr;
 	int *do_replace;
+	pgoff_t olen;
 	int ret;
 
-	src_blkaddr = f2fs_kvzalloc(sizeof(block_t) * len, GFP_KERNEL);
-	if (!src_blkaddr)
-		return -ENOMEM;
+	while (len) {
+		olen = min((pgoff_t)4 * ADDRS_PER_BLOCK, len);
 
-	do_replace = f2fs_kvzalloc(sizeof(int) * len, GFP_KERNEL);
-	if (!do_replace) {
-		kvfree(src_blkaddr);
-		return -ENOMEM;
-	}
+		src_blkaddr = f2fs_kvzalloc(sizeof(block_t) * olen, GFP_KERNEL);
+		if (!src_blkaddr)
+			return -ENOMEM;
 
-	ret = __read_out_blkaddrs(src_inode, src_blkaddr, do_replace, src, len);
-	if (ret)
-		goto roll_back;
+		do_replace = f2fs_kvzalloc(sizeof(int) * olen, GFP_KERNEL);
+		if (!do_replace) {
+			kvfree(src_blkaddr);
+			return -ENOMEM;
+		}
 
-	ret = __clone_blkaddrs(src_inode, dst_inode, src_blkaddr,
-					do_replace, src, dst, len, full);
-	if (ret)
-		goto roll_back;
+		ret = __read_out_blkaddrs(src_inode, src_blkaddr,
+					do_replace, src, olen);
+		if (ret)
+			goto roll_back;
 
-	kvfree(src_blkaddr);
-	kvfree(do_replace);
+		ret = __clone_blkaddrs(src_inode, dst_inode, src_blkaddr,
+					do_replace, src, dst, olen, full);
+		if (ret)
+			goto roll_back;
+
+		src += olen;
+		dst += olen;
+		len -= olen;
+
+		kvfree(src_blkaddr);
+		kvfree(do_replace);
+	}
 	return 0;
 
 roll_back:
-- 
2.8.3