swh:1:snp:77163734605b0ec556b01d897b7bb4a7e30d46b6
Revision 143f412eb4c7cc48b9eb4381f9133b7d36c68075 authored by Trond Myklebust on 14 March 2006, 05:20:46 UTC, committed by Linus Torvalds on 14 March 2006, 15:57:17 UTC
Based on an original patch by Mike O'Connor and Greg Banks of SGI. Mike states: A normal user can panic an NFS client and cause a local DoS with 'judicious'(?) use of O_DIRECT. Any O_DIRECT write to an NFS file where the user buffer starts with a valid mapped page and contains an unmapped page, will crash in this way. I haven't followed the code, but O_DIRECT reads with similar user buffers will probably also crash albeit in different ways. Details: when nfs_get_user_pages() calls get_user_pages(), it detects and correctly handles get_user_pages() returning an error, which happens if the first page covered by the user buffer's address range is unmapped. However, if the first page is mapped but some subsequent page isn't, get_user_pages() will return a positive number which is less than the number of pages requested (this behaviour is sort of analagous to a short write() call and appears to be intentional). nfs_get_user_pages() doesn't detect this and hands off the array of pages (whose last few elements are random rubbish from the newly allocated array memory) to it's caller, whence they go to nfs_direct_write_seg(), which then totally ignores the nr_pages it's given, and calculates its own idea of how many pages are in the array from the user buffer length. Needless to say, when it comes to transmit those uninitialised page* pointers, we see a crash in the network stack. Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
1 parent f9a3879
Tip revision: a4412fdd49dc011bcc2c0d81ac4cab7457092650 authored by Steven Rostedt (Google) on 21 November 2022, 15:44:03 UTC
error-injection: Add prompt for function error injection
error-injection: Add prompt for function error injection
Tip revision: a4412fd
File | Mode | Size |
---|---|---|
Documentation | ||
arch | ||
block | ||
crypto | ||
drivers | ||
fs | ||
include | ||
init | ||
ipc | ||
kernel | ||
lib | ||
mm | ||
net | ||
scripts | ||
security | ||
sound | ||
usr | ||
.gitignore | -rw-r--r-- | 424 bytes |
COPYING | -rw-r--r-- | 18.3 KB |
CREDITS | -rw-r--r-- | 87.5 KB |
Kbuild | -rw-r--r-- | 1.2 KB |
MAINTAINERS | -rw-r--r-- | 66.2 KB |
Makefile | -rw-r--r-- | 43.8 KB |
README | -rw-r--r-- | 15.1 KB |
REPORTING-BUGS | -rw-r--r-- | 3.0 KB |
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...