mirror of
https://github.com/torvalds/linux.git
synced 2024-12-24 11:51:27 +00:00
fs: don't allow splice read/write without explicit ops
default_file_splice_write is the last piece of generic code that uses set_fs to make the uaccess routines operate on kernel pointers. It implements a "fallback loop" for splicing from files that do not actually provide a proper splice_read method. The usual file systems and other high bandwidth instances all provide a ->splice_read, so this just removes support for various device drivers and procfs/debugfs files. If splice support for any of those turns out to be important it can be added back by switching them to the iter ops and using generic_file_splice_read. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Kees Cook <keescook@chromium.org> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
This commit is contained in:
parent
4d03e3cc59
commit
36e2c7421f
@ -1077,7 +1077,7 @@ ssize_t vfs_iter_write(struct file *file, struct iov_iter *iter, loff_t *ppos,
|
|||||||
}
|
}
|
||||||
EXPORT_SYMBOL(vfs_iter_write);
|
EXPORT_SYMBOL(vfs_iter_write);
|
||||||
|
|
||||||
ssize_t vfs_readv(struct file *file, const struct iovec __user *vec,
|
static ssize_t vfs_readv(struct file *file, const struct iovec __user *vec,
|
||||||
unsigned long vlen, loff_t *pos, rwf_t flags)
|
unsigned long vlen, loff_t *pos, rwf_t flags)
|
||||||
{
|
{
|
||||||
struct iovec iovstack[UIO_FASTIOV];
|
struct iovec iovstack[UIO_FASTIOV];
|
||||||
|
130
fs/splice.c
130
fs/splice.c
@ -342,89 +342,6 @@ const struct pipe_buf_operations nosteal_pipe_buf_ops = {
|
|||||||
};
|
};
|
||||||
EXPORT_SYMBOL(nosteal_pipe_buf_ops);
|
EXPORT_SYMBOL(nosteal_pipe_buf_ops);
|
||||||
|
|
||||||
static ssize_t kernel_readv(struct file *file, const struct kvec *vec,
|
|
||||||
unsigned long vlen, loff_t offset)
|
|
||||||
{
|
|
||||||
mm_segment_t old_fs;
|
|
||||||
loff_t pos = offset;
|
|
||||||
ssize_t res;
|
|
||||||
|
|
||||||
old_fs = get_fs();
|
|
||||||
set_fs(KERNEL_DS);
|
|
||||||
/* The cast to a user pointer is valid due to the set_fs() */
|
|
||||||
res = vfs_readv(file, (const struct iovec __user *)vec, vlen, &pos, 0);
|
|
||||||
set_fs(old_fs);
|
|
||||||
|
|
||||||
return res;
|
|
||||||
}
|
|
||||||
|
|
||||||
static ssize_t default_file_splice_read(struct file *in, loff_t *ppos,
|
|
||||||
struct pipe_inode_info *pipe, size_t len,
|
|
||||||
unsigned int flags)
|
|
||||||
{
|
|
||||||
struct kvec *vec, __vec[PIPE_DEF_BUFFERS];
|
|
||||||
struct iov_iter to;
|
|
||||||
struct page **pages;
|
|
||||||
unsigned int nr_pages;
|
|
||||||
unsigned int mask;
|
|
||||||
size_t offset, base, copied = 0;
|
|
||||||
ssize_t res;
|
|
||||||
int i;
|
|
||||||
|
|
||||||
if (pipe_full(pipe->head, pipe->tail, pipe->max_usage))
|
|
||||||
return -EAGAIN;
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Try to keep page boundaries matching to source pagecache ones -
|
|
||||||
* it probably won't be much help, but...
|
|
||||||
*/
|
|
||||||
offset = *ppos & ~PAGE_MASK;
|
|
||||||
|
|
||||||
iov_iter_pipe(&to, READ, pipe, len + offset);
|
|
||||||
|
|
||||||
res = iov_iter_get_pages_alloc(&to, &pages, len + offset, &base);
|
|
||||||
if (res <= 0)
|
|
||||||
return -ENOMEM;
|
|
||||||
|
|
||||||
nr_pages = DIV_ROUND_UP(res + base, PAGE_SIZE);
|
|
||||||
|
|
||||||
vec = __vec;
|
|
||||||
if (nr_pages > PIPE_DEF_BUFFERS) {
|
|
||||||
vec = kmalloc_array(nr_pages, sizeof(struct kvec), GFP_KERNEL);
|
|
||||||
if (unlikely(!vec)) {
|
|
||||||
res = -ENOMEM;
|
|
||||||
goto out;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
mask = pipe->ring_size - 1;
|
|
||||||
pipe->bufs[to.head & mask].offset = offset;
|
|
||||||
pipe->bufs[to.head & mask].len -= offset;
|
|
||||||
|
|
||||||
for (i = 0; i < nr_pages; i++) {
|
|
||||||
size_t this_len = min_t(size_t, len, PAGE_SIZE - offset);
|
|
||||||
vec[i].iov_base = page_address(pages[i]) + offset;
|
|
||||||
vec[i].iov_len = this_len;
|
|
||||||
len -= this_len;
|
|
||||||
offset = 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
res = kernel_readv(in, vec, nr_pages, *ppos);
|
|
||||||
if (res > 0) {
|
|
||||||
copied = res;
|
|
||||||
*ppos += res;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (vec != __vec)
|
|
||||||
kfree(vec);
|
|
||||||
out:
|
|
||||||
for (i = 0; i < nr_pages; i++)
|
|
||||||
put_page(pages[i]);
|
|
||||||
kvfree(pages);
|
|
||||||
iov_iter_advance(&to, copied); /* truncates and discards */
|
|
||||||
return res;
|
|
||||||
}
|
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* Send 'sd->len' bytes to socket from 'sd->file' at position 'sd->pos'
|
* Send 'sd->len' bytes to socket from 'sd->file' at position 'sd->pos'
|
||||||
* using sendpage(). Return the number of bytes sent.
|
* using sendpage(). Return the number of bytes sent.
|
||||||
@ -788,33 +705,6 @@ done:
|
|||||||
|
|
||||||
EXPORT_SYMBOL(iter_file_splice_write);
|
EXPORT_SYMBOL(iter_file_splice_write);
|
||||||
|
|
||||||
static int write_pipe_buf(struct pipe_inode_info *pipe, struct pipe_buffer *buf,
|
|
||||||
struct splice_desc *sd)
|
|
||||||
{
|
|
||||||
int ret;
|
|
||||||
void *data;
|
|
||||||
loff_t tmp = sd->pos;
|
|
||||||
|
|
||||||
data = kmap(buf->page);
|
|
||||||
ret = __kernel_write(sd->u.file, data + buf->offset, sd->len, &tmp);
|
|
||||||
kunmap(buf->page);
|
|
||||||
|
|
||||||
return ret;
|
|
||||||
}
|
|
||||||
|
|
||||||
static ssize_t default_file_splice_write(struct pipe_inode_info *pipe,
|
|
||||||
struct file *out, loff_t *ppos,
|
|
||||||
size_t len, unsigned int flags)
|
|
||||||
{
|
|
||||||
ssize_t ret;
|
|
||||||
|
|
||||||
ret = splice_from_pipe(pipe, out, ppos, len, flags, write_pipe_buf);
|
|
||||||
if (ret > 0)
|
|
||||||
*ppos += ret;
|
|
||||||
|
|
||||||
return ret;
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* generic_splice_sendpage - splice data from a pipe to a socket
|
* generic_splice_sendpage - splice data from a pipe to a socket
|
||||||
* @pipe: pipe to splice from
|
* @pipe: pipe to splice from
|
||||||
@ -836,15 +726,23 @@ ssize_t generic_splice_sendpage(struct pipe_inode_info *pipe, struct file *out,
|
|||||||
|
|
||||||
EXPORT_SYMBOL(generic_splice_sendpage);
|
EXPORT_SYMBOL(generic_splice_sendpage);
|
||||||
|
|
||||||
|
static int warn_unsupported(struct file *file, const char *op)
|
||||||
|
{
|
||||||
|
pr_debug_ratelimited(
|
||||||
|
"splice %s not supported for file %pD4 (pid: %d comm: %.20s)\n",
|
||||||
|
op, file, current->pid, current->comm);
|
||||||
|
return -EINVAL;
|
||||||
|
}
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* Attempt to initiate a splice from pipe to file.
|
* Attempt to initiate a splice from pipe to file.
|
||||||
*/
|
*/
|
||||||
static long do_splice_from(struct pipe_inode_info *pipe, struct file *out,
|
static long do_splice_from(struct pipe_inode_info *pipe, struct file *out,
|
||||||
loff_t *ppos, size_t len, unsigned int flags)
|
loff_t *ppos, size_t len, unsigned int flags)
|
||||||
{
|
{
|
||||||
if (out->f_op->splice_write)
|
if (unlikely(!out->f_op->splice_write))
|
||||||
return out->f_op->splice_write(pipe, out, ppos, len, flags);
|
return warn_unsupported(out, "write");
|
||||||
return default_file_splice_write(pipe, out, ppos, len, flags);
|
return out->f_op->splice_write(pipe, out, ppos, len, flags);
|
||||||
}
|
}
|
||||||
|
|
||||||
/*
|
/*
|
||||||
@ -866,9 +764,9 @@ static long do_splice_to(struct file *in, loff_t *ppos,
|
|||||||
if (unlikely(len > MAX_RW_COUNT))
|
if (unlikely(len > MAX_RW_COUNT))
|
||||||
len = MAX_RW_COUNT;
|
len = MAX_RW_COUNT;
|
||||||
|
|
||||||
if (in->f_op->splice_read)
|
if (unlikely(!in->f_op->splice_read))
|
||||||
return in->f_op->splice_read(in, ppos, pipe, len, flags);
|
return warn_unsupported(in, "read");
|
||||||
return default_file_splice_read(in, ppos, pipe, len, flags);
|
return in->f_op->splice_read(in, ppos, pipe, len, flags);
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
|
@ -1894,8 +1894,6 @@ ssize_t rw_copy_check_uvector(int type, const struct iovec __user * uvector,
|
|||||||
|
|
||||||
extern ssize_t vfs_read(struct file *, char __user *, size_t, loff_t *);
|
extern ssize_t vfs_read(struct file *, char __user *, size_t, loff_t *);
|
||||||
extern ssize_t vfs_write(struct file *, const char __user *, size_t, loff_t *);
|
extern ssize_t vfs_write(struct file *, const char __user *, size_t, loff_t *);
|
||||||
extern ssize_t vfs_readv(struct file *, const struct iovec __user *,
|
|
||||||
unsigned long, loff_t *, rwf_t);
|
|
||||||
extern ssize_t vfs_copy_file_range(struct file *, loff_t , struct file *,
|
extern ssize_t vfs_copy_file_range(struct file *, loff_t , struct file *,
|
||||||
loff_t, size_t, unsigned int);
|
loff_t, size_t, unsigned int);
|
||||||
extern ssize_t generic_copy_file_range(struct file *file_in, loff_t pos_in,
|
extern ssize_t generic_copy_file_range(struct file *file_in, loff_t pos_in,
|
||||||
|
Loading…
Reference in New Issue
Block a user