CVE-2015-8830: Other (NVD-CWE-Other)
value: Integer overflow in the aio_setup_single_vector function in fs/aio.c in the Linux kernel 4.0 allows local users to cause a denial of service or possibly have unspecified other impact via a large AIO iovec.  NOTE: this vulnerability exists because of a CVE-2012-6701 regression.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 7.8
Published: 2016-05-02T10:59Z
Repository: https://github.com/torvalds/linux
Language: C
Files changed: fs/aio.c
Commit date: 2015-04-11 22:26:45 -0400
Commit message: aio: lift iov_iter_init() into aio_setup_..._rw()

the only non-trivial detail is that we do it before rw_verify_area(),
so we'd better cap the length ourselves in aio_setup_single_rw()
case (for vectored case rw_copy_check_uvector() will do that for us).

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Diff: diff --git a/fs/aio.c b/fs/aio.c
index 435ca29eca3143..7816e8ec3c0e10 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -1355,11 +1355,12 @@ typedef ssize_t (rw_iter_op)(struct kiocb *, struct iov_iter *);
 static ssize_t aio_setup_vectored_rw(struct kiocb *kiocb,
 				     int rw, char __user *buf,
 				     unsigned long *nr_segs,
 				     size_t *len,
 				     struct iovec **iovec,
-				     bool compat)
+				     bool compat,
+				     struct iov_iter *iter)
 {
 	ssize_t ret;
 
 	*nr_segs = *len;
 
@@ -1376,25 +1377,30 @@ static ssize_t aio_setup_vectored_rw(struct kiocb *kiocb,
 	if (ret < 0)
 		return ret;
 
 	/* len now reflect bytes instead of segs */
 	*len = ret;
+	iov_iter_init(iter, rw, *iovec, *nr_segs, *len);
 	return 0;
 }
 
 static ssize_t aio_setup_single_vector(struct kiocb *kiocb,
 				       int rw, char __user *buf,
 				       unsigned long *nr_segs,
 				       size_t len,
-				       struct iovec *iovec)
+				       struct iovec *iovec,
+				       struct iov_iter *iter)
 {
+	if (len > MAX_RW_COUNT)
+		len = MAX_RW_COUNT;
 	if (unlikely(!access_ok(!rw, buf, len)))
 		return -EFAULT;
 
 	iovec->iov_base = buf;
 	iovec->iov_len = len;
 	*nr_segs = 1;
+	iov_iter_init(iter, rw, iovec, *nr_segs, len);
 	return 0;
 }
 
 /*
  * aio_run_iocb:
@@ -1436,14 +1442,14 @@ static ssize_t aio_run_iocb(struct kiocb *req, unsigned opcode,
 		if (!rw_op && !iter_op)
 			return -EINVAL;
 
 		if (opcode == IOCB_CMD_PREADV || opcode == IOCB_CMD_PWRITEV)
 			ret = aio_setup_vectored_rw(req, rw, buf, &nr_segs,
-						&len, &iovec, compat);
+						&len, &iovec, compat, &iter);
 		else
 			ret = aio_setup_single_vector(req, rw, buf, &nr_segs,
-						  len, iovec);
+						  len, iovec, &iter);
 		if (!ret)
 			ret = rw_verify_area(rw, file, &req->ki_pos, len);
 		if (ret < 0) {
 			if (iovec != inline_vecs)
 				kfree(iovec);
@@ -1461,14 +1467,13 @@ static ssize_t aio_run_iocb(struct kiocb *req, unsigned opcode,
 
 		if (rw == WRITE)
 			file_start_write(file);
 
 		if (iter_op) {
-			iov_iter_init(&iter, rw, iovec, nr_segs, len);
 			ret = iter_op(req, &iter);
 		} else {
-			ret = rw_op(req, iovec, nr_segs, req->ki_pos);
+			ret = rw_op(req, iter.iov, iter.nr_segs, req->ki_pos);
 		}
 
 		if (rw == WRITE)
 			file_end_write(file);
 		break;

Vulnerable code: 				     bool compat)
				       struct iovec *iovec)
						&len, &iovec, compat);
						  len, iovec);
			iov_iter_init(&iter, rw, iovec, nr_segs, len);
			ret = rw_op(req, iovec, nr_segs, req->ki_pos);
Fixed code: 				     bool compat,
				     struct iov_iter *iter)
	iov_iter_init(iter, rw, *iovec, *nr_segs, *len);
				       struct iovec *iovec,
				       struct iov_iter *iter)
	if (len > MAX_RW_COUNT)
		len = MAX_RW_COUNT;
	iov_iter_init(iter, rw, iovec, *nr_segs, len);
						&len, &iovec, compat, &iter);
						  len, iovec, &iter);
			ret = rw_op(req, iter.iov, iter.nr_segs, req->ki_pos);