RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-25 05:27:43 +00:00
Code Issues Activity Actions

Kernel: Refuse excessively long iovec list

Browse source 
If a program attempts to write from more than a million different locations,
there is likely shenaniganery afoot! Refuse to write to prevent kmem exhaustion.

Found by fuzz-syscalls. Can be reproduced by running this in the Shell:

    $ syscall writev 1 [ 0 ] 0x08000000
This commit is contained in:
Ben Wiederhake 2021-02-11 20:38:39 +01:00 • committed by Andreas Kling
parent 987b7f7917
commit c6027ed7cc
1 changed files with 3 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

9
Kernel/Syscalls/write.cpp
View file

@ -37,12 +37,9 @@ ssize_t Process::sys$writev(int fd, Userspace<const struct iovec*> iov, int iov_
if (iov_count < 0)
return -EINVAL;
{
Checked checked_iov_count = sizeof(iovec);
checked_iov_count *= iov_count;
if (checked_iov_count.has_overflow())
return -EFAULT;
}
// Arbitrary pain threshold.
if (iov_count > (int)MiB)
return -EFAULT;
u64 total_length = 0;
Vector<iovec, 32> vecs;