CVE-2014-7822 (C, published 2015-03-16T10:59Z)
Description: value: The implementation of certain splice_write file operations in the Linux kernel before 3.16 does not enforce a restriction on the maximum size of a single file, which allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted splice system call, as demonstrated by use of a file descriptor associated with an ext4 filesystem.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://github.com/torvalds/linux
Files changed:
fs/block_dev.c
fs/exofs/file.c
fs/ext2/file.c
fs/ext3/file.c
fs/ext4/file.c
fs/f2fs/file.c
fs/gfs2/file.c
fs/jfs/file.c
fs/ramfs/file-mmu.c
fs/ramfs/file-nommu.c
fs/reiserfs/file.c
fs/splice.c
fs/ubifs/file.c
fs/xfs/xfs_file.c
fs/xfs/xfs_trace.h
include/linux/fs.h
Commit message: ->splice_write() via ->write_iter()

iter_file_splice_write() - a ->splice_write() instance that gathers the
pipe buffers, builds a bio_vec-based iov_iter covering those and feeds
it to ->write_iter().  A bunch of simple cases coverted to that...

[AV: fixed the braino spotted by Cyrill]

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>


Vulnerable code:
	.splice_write	= generic_file_splice_write,
	.splice_write	= generic_file_splice_write,
	.splice_write	= generic_file_splice_write,
	.splice_write	= generic_file_splice_write,
	.splice_write	= generic_file_splice_write,
	.splice_write	= generic_file_splice_write,
	.splice_write	= generic_file_splice_write,
	.splice_write	= generic_file_splice_write,
	.splice_write	= generic_file_splice_write,
	.splice_write	= generic_file_splice_write,
	.splice_write		= generic_file_splice_write,
	.splice_write = generic_file_splice_write,
	.splice_write	= generic_file_splice_write,
/*
 * xfs_file_splice_write() does not use xfs_rw_ilock() because
 * generic_file_splice_write() takes the i_mutex itself. This, in theory,
 * couuld cause lock inversions between the aio_write path and the splice path
 * if someone is doing concurrent splice(2) based writes and write(2) based
 * writes to the same inode. The only real way to fix this is to re-implement
 * the generic code here with correct locking orders.
 */
STATIC ssize_t
xfs_file_splice_write(
	struct pipe_inode_info	*pipe,
	struct file		*outfilp,
	loff_t			*ppos,
	size_t			count,
	unsigned int		flags)
{
	struct inode		*inode = outfilp->f_mapping->host;
	struct xfs_inode	*ip = XFS_I(inode);
	int			ioflags = 0;
	ssize_t			ret;

	XFS_STATS_INC(xs_write_calls);

	if (outfilp->f_mode & FMODE_NOCMTIME)
		ioflags |= IO_INVIS;

	if (XFS_FORCED_SHUTDOWN(ip->i_mount))
		return -EIO;

	xfs_ilock(ip, XFS_IOLOCK_EXCL);

	trace_xfs_file_splice_write(ip, count, *ppos, ioflags);

	ret = generic_file_splice_write(pipe, outfilp, ppos, count, flags);
	if (ret > 0)
		XFS_STATS_ADD(xs_write_bytes, ret);

	xfs_iunlock(ip, XFS_IOLOCK_EXCL);
	return ret;
}

	.splice_write	= xfs_file_splice_write,
DEFINE_RW_EVENT(xfs_file_splice_write);

Fixed code:
	.splice_write	= iter_file_splice_write,
	.splice_write	= iter_file_splice_write,
	.splice_write	= iter_file_splice_write,
	.splice_write	= iter_file_splice_write,
	.splice_write	= iter_file_splice_write,
	.splice_write	= iter_file_splice_write,
	.splice_write	= iter_file_splice_write,
	.splice_write	= iter_file_splice_write,
	.splice_write	= iter_file_splice_write,
	.splice_write	= iter_file_splice_write,
	.splice_write		= iter_file_splice_write,
	.splice_write = iter_file_splice_write,
#include <linux/aio.h>
/**
 * iter_file_splice_write - splice data from a pipe to a file
 * @pipe:	pipe info
 * @out:	file to write to
 * @ppos:	position in @out
 * @len:	number of bytes to splice
 * @flags:	splice modifier flags
 *
 * Description:
 *    Will either move or copy pages (determined by @flags options) from
 *    the given pipe inode to the given file.
 *    This one is ->write_iter-based.
 *
 */
ssize_t
iter_file_splice_write(struct pipe_inode_info *pipe, struct file *out,
			  loff_t *ppos, size_t len, unsigned int flags)
{
	struct splice_desc sd = {
		.total_len = len,
		.flags = flags,
		.pos = *ppos,
		.u.file = out,
	};
	int nbufs = pipe->buffers;
	struct bio_vec *array = kcalloc(nbufs, sizeof(struct bio_vec),
					GFP_KERNEL);
	ssize_t ret;

	if (unlikely(!array))
		return -ENOMEM;

	pipe_lock(pipe);

	splice_from_pipe_begin(&sd);
	while (sd.total_len) {
		struct iov_iter from;
		struct kiocb kiocb;
		size_t left;
		int n, idx;

		ret = splice_from_pipe_next(pipe, &sd);
		if (ret <= 0)
			break;

		if (unlikely(nbufs < pipe->buffers)) {
			kfree(array);
			nbufs = pipe->buffers;
			array = kcalloc(nbufs, sizeof(struct bio_vec),
					GFP_KERNEL);
			if (!array) {
				ret = -ENOMEM;
				break;
			}
		}

		/* build the vector */
		left = sd.total_len;
		for (n = 0, idx = pipe->curbuf; left && n < pipe->nrbufs; n++, idx++) {
			struct pipe_buffer *buf = pipe->bufs + idx;
			size_t this_len = buf->len;

			if (this_len > left)
				this_len = left;

			if (idx == pipe->buffers - 1)
				idx = -1;

			ret = buf->ops->confirm(pipe, buf);
			if (unlikely(ret)) {
				if (ret == -ENODATA)
					ret = 0;
				goto done;
			}

			array[n].bv_page = buf->page;
			array[n].bv_len = this_len;
			array[n].bv_offset = buf->offset;
			left -= this_len;
		}

		/* ... iov_iter */
		from.type = ITER_BVEC | WRITE;
		from.bvec = array;
		from.nr_segs = n;
		from.count = sd.total_len - left;
		from.iov_offset = 0;

		/* ... and iocb */
		init_sync_kiocb(&kiocb, out);
		kiocb.ki_pos = sd.pos;
		kiocb.ki_nbytes = sd.total_len - left;

		/* now, send it */
		ret = out->f_op->write_iter(&kiocb, &from);
		if (-EIOCBQUEUED == ret)
			ret = wait_on_sync_kiocb(&kiocb);

		if (ret <= 0)
			break;

		sd.num_spliced += ret;
		sd.total_len -= ret;
		*ppos = sd.pos = kiocb.ki_pos;

		/* dismiss the fully eaten buffers, adjust the partial one */
		while (ret) {
			struct pipe_buffer *buf = pipe->bufs + pipe->curbuf;
			if (ret >= buf->len) {
				const struct pipe_buf_operations *ops = buf->ops;
				ret -= buf->len;
				buf->len = 0;
				buf->ops = NULL;
				ops->release(pipe, buf);
				pipe->curbuf = (pipe->curbuf + 1) & (pipe->buffers - 1);
				pipe->nrbufs--;
				if (pipe->files)
					sd.need_wakeup = true;
			} else {
				buf->offset += ret;
				buf->len -= ret;
				ret = 0;
			}
		}
	}
done:
	kfree(array);
	splice_from_pipe_end(pipe, &sd);

	pipe_unlock(pipe);

	if (sd.num_spliced)
		ret = sd.num_spliced;

	return ret;
}

EXPORT_SYMBOL(iter_file_splice_write);

	.splice_write	= iter_file_splice_write,
	.splice_write	= iter_file_splice_write,
extern ssize_t iter_file_splice_write(struct pipe_inode_info *,
		struct file *, loff_t *, size_t, unsigned int);