diff options
| author | Jan Kara <jack@suse.cz> | 2026-10-22 13:25:35 +0200 |
|---|---|---|
| committer | Christian Brauner <brauner@kernel.org> | 2026-10-30 16:12:43 +0100 |
| commit | b44341e39d856e4cc6ad8ed94ebffd440f39846c (patch) | |
| tree | 2aae81a868c9f0585c7872a0e1f104ecfe2c5033 | |
| parent | 8457ca071faba9dec2dde99f78da9c5af289e955 (diff) | |
| download | linux-b44341e39d856e4cc6ad8ed94ebffd440f39846c.tar.gz linux-b44341e39d856e4cc6ad8ed94ebffd440f39846c.zip | |
aio: avoid request count overflow in ioctx_alloc()
ioctx_alloc() saves the 32-bit nr_events in max_reqs, then doubles
nr_events before checking the ring-size bound. For
nr_events=0x80000001, the doubled value wraps to 2, so the ring check
passes and aio_setup_ring() builds a one-page/127-slot ring. The
original 0x80000001 is still stored in ctx->max_reqs and charged to the
global aio_nr quota.
If an administrator has raised fs.aio-max-nr to at least 0x80000001,
an unprivileged process can create that context and make later normal
io_setup() calls fail with -EAGAIN until the wrapped context is
destroyed.
Check for too large number of requests before multiplying.
Link: https://lore.kernel.org/all/20261022091748.3653127-1-teel4res@gmail.com
Reported-by: Cheng Yongkang <teel4res@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20261022112534.3513745-2-jack@suse.cz
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
| -rw-r--r-- | fs/aio.c | 5 |
1 files changed, 2 insertions, 3 deletions
@@ -816,13 +816,12 @@ static struct kioctx *ioctx_alloc(unsigned nr_events) * counters at a time, so make sure that isn't 0: */ nr_events = max(nr_events, num_possible_cpus() * 4); - nr_events *= 2; - /* Prevent overflows */ - if (nr_events > (0x10000000U / sizeof(struct io_event))) { + if (nr_events > (0x8000000U / sizeof(struct io_event))) { pr_debug("ENOMEM: nr_events too high\n"); return ERR_PTR(-EINVAL); } + nr_events *= 2; if (!nr_events || (unsigned long)max_reqs > aio_max_nr) return ERR_PTR(-EAGAIN); |