Xiongwei Song 0946fdd929 floppy: Add max size check for user space request ... [ Upstream commit 545a32498c536ee152331cd2e7d2416aa0f20e01 ] We need to check the max request size that is from user space before allocating pages. If the request size exceeds the limit, return -EINVAL. This check can avoid the warning below from page allocator. WARNING: CPU: 3 PID: 16525 at mm/page_alloc.c:5344 current_gfp_context include/linux/sched/mm.h:195 [inline] WARNING: CPU: 3 PID: 16525 at mm/page_alloc.c:5344 __alloc_pages+0x45d/0x500 mm/page_alloc.c:5356 Modules linked in: CPU: 3 PID: 16525 Comm: syz-executor.3 Not tainted 5.15.0-syzkaller #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 RIP: 0010:__alloc_pages+0x45d/0x500 mm/page_alloc.c:5344 Code: be c9 00 00 00 48 c7 c7 20 4a 97 89 c6 05 62 32 a7 0b 01 e8 74 9a 42 07 e9 6a ff ff ff 0f 0b e9 a0 fd ff ff 40 80 e5 3f eb 88 <0f> 0b e9 18 ff ff ff 4c 89 ef 44 89 e6 45 31 ed e8 1e 76 ff ff e9 RSP: 0018:ffffc90023b87850 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 1ffff92004770f0b RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000033 RDI: 0000000000010cc1 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001 R10: ffffffff81bb4686 R11: 0000000000000001 R12: ffffffff902c1960 R13: 0000000000000033 R14: 0000000000000000 R15: ffff88804cf64a30 FS: 0000000000000000(0000) GS:ffff88802cd00000(0063) knlGS:00000000f44b4b40 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: 000000002c921000 CR3: 000000004f507000 CR4: 0000000000150ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> alloc_pages+0x1a7/0x300 mm/mempolicy.c:2191 __get_free_pages+0x8/0x40 mm/page_alloc.c:5418 raw_cmd_copyin drivers/block/floppy.c:3113 [inline] raw_cmd_ioctl drivers/block/floppy.c:3160 [inline] fd_locked_ioctl+0x12e5/0x2820 drivers/block/floppy.c:3528 fd_ioctl drivers/block/floppy.c:3555 [inline] fd_compat_ioctl+0x891/0x1b60 drivers/block/floppy.c:3869 compat_blkdev_ioctl+0x3b8/0x810 block/ioctl.c:662 __do_compat_sys_ioctl+0x1c7/0x290 fs/ioctl.c:972 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] __do_fast_syscall_32+0x65/0xf0 arch/x86/entry/common.c:178 do_fast_syscall_32+0x2f/0x70 arch/x86/entry/common.c:203 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c Reported-by: syzbot+23a02c7df2cf2bc93fa2@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/20211116131033.27685-1-sxwjean@me.com Signed-off-by: Xiongwei Song <sxwjean@gmail.com> Signed-off-by: Denis Efremov <efremov@linux.com> Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Sasha Levin <sashal@kernel.org>		2022-01-27 10:54:14 +01:00
..
aoe	block: lift setting the readahead size into the block layer	2020-09-24 13:43:39 -06:00
drbd	block-5.10-2020-10-12	2020-10-13 12:12:44 -07:00
mtip32xx
paride	paride/pcd: use bdev_check_media_change	2020-09-10 09:32:31 -06:00
rnbd	block/rnbd-clt: Check the return value of the function rtrs_clt_query	2021-05-19 10:13:06 +02:00
rsxx	block: rsxx: fix error return code of rsxx_pci_probe()	2021-03-17 17:06:33 +01:00
xen-blkback	xen-blkback: fix compatibility bug with single page rings	2021-05-14 09:50:21 +02:00
zram	zram: off by one in read_block_state()	2021-11-18 14:04:27 +01:00
amiflop.c	amiflop: use bdev_check_media_change	2020-09-10 09:32:30 -06:00
ataflop.c	ataflop: use bdev_check_media_change	2020-09-10 09:32:30 -06:00
brd.c	bdi: remove BDI_CAP_SYNCHRONOUS_IO	2020-09-24 13:43:39 -06:00
cryptoloop.c	cryptoloop: add a deprecation warning	2021-09-08 08:49:01 +02:00
floppy.c	floppy: Add max size check for user space request	2022-01-27 10:54:14 +01:00
Kconfig	cryptoloop: add a deprecation warning	2021-09-08 08:49:01 +02:00
loop.c	loop: Use blk_validate_block_size() to validate block size	2021-11-21 13:46:35 +01:00
loop.h
Makefile
nbd.c	Revert "block: nbd: add sanity check for first_minor"	2021-09-16 12:51:23 +02:00
null_blk_main.c	null_blk: fix command timeout completion handling	2021-04-16 11:43:21 +02:00
null_blk_trace.c
null_blk_trace.h
null_blk_zoned.c	drivers/block/null_blk/main: Fix a double free in null_init.	2021-05-14 09:50:28 +02:00
null_blk.h	null_blk: fix command timeout completion handling	2021-04-16 11:43:21 +02:00
pktcdvd.c	pktcdvd: use blkdev_get_by_dev instead of open coding it	2020-09-23 10:43:19 -06:00
ps3disk.c
ps3vram.c
rbd_types.h
rbd.c	rbd: always kick acquire on "acquired" and "released" notifications	2021-07-28 14:35:46 +02:00
skd_main.c	skd_main: remove unused including <linux/version.h>	2020-10-17 08:11:14 -06:00
skd_s1120.h
sunvdc.c
swim_asm.S
swim.c	swim: simplify media change handling	2020-09-10 09:32:30 -06:00
swim3.c	swim3: use bdev_check_media_changed	2020-09-10 09:32:31 -06:00
sx8.c
umem.c	umem: fix error return code in mm_pci_probe()	2021-03-30 14:31:50 +02:00
umem.h
virtio_blk.c	virtio-blk: Fix memory leak among suspend/resume procedure	2021-07-20 16:05:49 +02:00
xen-blkfront.c	xen/blkfront: harden blkfront against event channel storms	2021-12-22 09:30:59 +01:00
xsysace.c	xsysace: use platform_get_resource() and platform_get_irq_optional()	2020-10-29 08:22:33 -06:00
z2ram.c