linux-kernel - [GIT PULL] splice: fix for 5.5

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 25 Nov 2019 15:03:26 -0800
From:   "Darrick J. Wong" <djwong@...nel.org>
To:     Linus Torvalds <torvalds@...ux-foundation.org>
Cc:     "Darrick J. Wong" <djwong@...nel.org>,
        linux-fsdevel@...r.kernel.org, linux-xfs@...r.kernel.org,
        linux-kernel@...r.kernel.org, agruenba@...hat.com
Subject: [GIT PULL] splice: fix for 5.5

Hi Linus,

Please pull this single patch for 5.5 that fixes some questionable pipe
behavior in the splice code.  Specifically, whenever we perform a read
into a pipe, we now clamp the read request to the length of the pipe
buffer since there's no point in asking for more than we can handle.
We already fixed this in one place, but Andreas Gruenbacher found
another place where we could overflow, and requested a second fix.

The branch merges cleanly against this morning's HEAD and survived a few
days' worth of xfstests.  The merge was completely straightforward, so
please let me know if you run into anything weird.

--D

The following changes since commit 4f5cafb5cb8471e54afdc9054d973535614f7675:

  Linux 5.4-rc3 (2019-10-13 16:37:36 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/fs/xfs/xfs-linux.git tags/vfs-5.5-merge-1

for you to fetch changes up to 3253d9d093376d62b4a56e609f15d2ec5085ac73:

  splice: only read in as much information as there is pipe buffer space (2019-10-15 08:44:32 -0700)

----------------------------------------------------------------
New code for 5.5:
- Fix another place in the splice code where a pipe could ask a
filesystem for a longer read than the pipe actually has free buffer
space.

----------------------------------------------------------------
Darrick J. Wong (1):
      splice: only read in as much information as there is pipe buffer space

 fs/splice.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)