浏览代码

Kernel: Refuse excessively long iovec list, also in readv

This bug is a good example why copy-paste code should eventually be eliminated
from the code base: Apparently the code was copied from read.cpp before
c6027ed7cce901dc0d2b6f68002a911178ae587f, so the same bug got introduced here.

To recap: A malicious program can ask the Kernel to prepare sys-ing to
a huge amount of iovecs. The Kernel must first copy all the vector locations
into 'vecs', and before that allocates an arbitrary amount of memory:
    vecs.resize(iov_count);
This can cause Kernel memory exhaustion, triggered by any malicious userland
program.
Ben Wiederhake 4 年之前
父节点
当前提交
fbb85f9b2f
共有 1 个文件被更改,包括 3 次插入6 次删除
  1. 3 6
      Kernel/Syscalls/read.cpp

+ 3 - 6
Kernel/Syscalls/read.cpp

@@ -36,12 +36,9 @@ ssize_t Process::sys$readv(int fd, Userspace<const struct iovec*> iov, int iov_c
     if (iov_count < 0)
         return -EINVAL;
 
-    {
-        Checked checked_iov_count = sizeof(iovec);
-        checked_iov_count *= iov_count;
-        if (checked_iov_count.has_overflow())
-            return -EFAULT;
-    }
+    // Arbitrary pain threshold.
+    if (iov_count > (int)MiB)
+        return -EFAULT;
 
     u64 total_length = 0;
     Vector<iovec, 32> vecs;