CINXE.COM

<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>LKML: "H. Peter Anvin": [PATCH] Limit sendfile() to 2^31-PAGE_CACHE_SIZE bytes without error</title><link href="/css/message.css" rel="stylesheet" type="text/css" /><link href="/css/wrap.css" rel="alternate stylesheet" type="text/css" title="wrap" /><link href="/css/nowrap.css" rel="stylesheet" type="text/css" title="nowrap" /><link href="/favicon.ico" rel="shortcut icon" /><script src="/js/simple-calendar.js" type="text/javascript"></script><script src="/js/styleswitcher.js" type="text/javascript"></script><link rel="alternate" type="application/rss+xml" title="lkml.org : last 100 messages" href="/rss.php" /><link rel="alternate" type="application/rss+xml" title="lkml.org : last messages by "H. Peter Anvin"" href="/groupie.php?aid=90" /><script> var _paq = window._paq = window._paq || []; /* tracker methods like "setCustomDimension" should be called before "trackPageView" */ _paq.push(["setDoNotTrack", true]); _paq.push(["disableCookies"]); _paq.push(['trackPageView']); _paq.push(['enableLinkTracking']); (function() { var u="//m.lkml.org/"; _paq.push(['setTrackerUrl', u+'matomo.php']); _paq.push(['setSiteId', '1']); var d=document, g=d.createElement('script'), s=d.getElementsByTagName('script')[0]; g.async=true; g.src=u+'matomo.js'; s.parentNode.insertBefore(g,s); })(); </script></head><body onload="es.jasper.simpleCalendar.init();" itemscope="itemscope" itemtype="http://schema.org/BlogPosting"><table border="0" cellpadding="0" cellspacing="0"><tr><td width="180" align="center"><a href="/"><img style="border:0;width:135px;height:32px" src="/images/toprowlk.gif" alt="lkml.org" /></a></td><td width="32">聽</td><td class="nb"><div><a class="nb" href="/lkml"> [lkml]</a> 聽 <a class="nb" href="/lkml/2006"> [2006]</a> 聽 <a class="nb" href="/lkml/2006/1"> [Jan]</a> 聽 <a class="nb" href="/lkml/2006/1/4"> [4]</a> 聽 <a class="nb" href="/lkml/last100"> [last100]</a> 聽 <a href="/rss.php"><img src="/images/rss-or.gif" border="0" alt="RSS Feed" /></a></div><div>Views: <a href="#" class="nowrap" onclick="setActiveStyleSheet('wrap');return false;">[wrap]</a><a href="#" class="wrap" onclick="setActiveStyleSheet('nowrap');return false;">[no wrap]</a> 聽 <a class="nb" href="/lkml/mheaders/2006/1/4/5" onclick="this.href='/lkml/headers'+'/2006/1/4/5';">[headers]</a>聽 <a href="/lkml/bounce/2006/1/4/5">[forward]</a>聽 </div></td><td width="32">聽</td></tr><tr><td valign="top"><div class="es-jasper-simpleCalendar" baseurl="/lkml/"></div><div class="threadlist">Messages in this thread</div><ul class="threadlist"><li class="root"><a href="/lkml/2006/1/4/5">First message in thread</a></li><li class="origin"><a href="/lkml/2006/1/4/180">"H. Peter Anvin"</a><ul><li><a href="/lkml/2006/1/4/180">Linus Torvalds</a><ul><li><a href="/lkml/2006/1/4/190">Ulrich Drepper</a><ul><li><a href="/lkml/2006/1/4/236">"H. Peter Anvin"</a></li></ul></li><li><a href="/lkml/2006/1/4/235">Linus Torvalds</a><ul><li><a href="/lkml/2006/1/4/241">"H. Peter Anvin"</a><ul><li><a href="/lkml/2006/1/4/247">Linus Torvalds</a></li></ul></li></ul></li></ul></li></ul></li></ul><div class="threadlist">Patch in this message</div><ul class="threadlist"><li><a href="/lkml/diff/2006/1/4/5/1">Get diff 1</a></li></ul></td><td width="32" rowspan="2" class="c" valign="top"><img src="/images/icornerl.gif" width="32" height="32" alt="/" /></td><td class="c" rowspan="2" valign="top" style="padding-top: 1em"><table><tr><td><table><tr><td class="lp">Date</td><td class="rp" itemprop="datePublished">Tue, 03 Jan 2006 21:33:22 -0800</td></tr><tr><td class="lp">From</td><td class="rp" itemprop="author">"H. Peter Anvin" <></td></tr><tr><td class="lp">Subject</td><td class="rp" itemprop="name">[PATCH] Limit sendfile() to 2^31-PAGE_CACHE_SIZE bytes without error</td></tr></table></td><td></td></tr></table><pre itemprop="articleBody">sendfile() has a limit of 2^31-1 bytes even on 64-bit platforms. Linus <br />wants to maintain it in order to avoid potential future security bugs <br />(always a good thing.)<br /><br />This patch changes the behaviour from returning EINVAL when this limit <br />is exceeded to returning a short count. This means that a <br />properly-written userspace program will simply loop around and continue; <br /> it will expose bugs in improperly-written userspace programs, which is <br />also a good thing. Additionally, the limit becomes an issue that is <br />completely contained within the kernel, and not encoded in the kernel <br />ABI, so it can be changed in the future.<br /><br />(I set the limit to 2^31-PAGE_CACHE_SIZE so that a transfer that starts <br />at the beginning of the file will continue to be page-aligned.)<br /><br />The<br /><br />Signed-off-by: H. Peter Anvin <hpa@zytor.com><br />diff --git a/fs/read_write.c b/fs/read_write.c<br />index a091ee4..3712886 100644<br />--- a/fs/read_write.c<br />+++ b/fs/read_write.c<br />@@ -9,6 +9,7 @@<br /> #include <linux/fcntl.h><br /> #include <linux/file.h><br /> #include <linux/uio.h><br />+#include <linux/pagemap.h><br /> #include <linux/smp_lock.h><br /> #include <linux/fsnotify.h><br /> #include <linux/security.h><br />@@ -631,6 +632,9 @@ static ssize_t do_sendfile(int out_fd, i<br /> ssize_t retval;<br /> int fput_needed_in, fput_needed_out;<br /> <br />+ /* Avoid potential security holes. User space will get a short count and should loop. */<br />+ count = min(count, (size_t)0x80000000-PAGE_CACHE_SIZE);<br />+<br /> /*<br /> * Get input file, and verify that it is ok..<br /> */</pre></td><td width="32" rowspan="2" class="c" valign="top"><img src="/images/icornerr.gif" width="32" height="32" alt="\" /></td></tr><tr><td align="right" valign="bottom"> 聽 </td></tr><tr><td align="right" valign="bottom">聽</td><td class="c" valign="bottom" style="padding-bottom: 0px"><img src="/images/bcornerl.gif" width="32" height="32" alt="\" /></td><td class="c">聽</td><td class="c" valign="bottom" style="padding-bottom: 0px"><img src="/images/bcornerr.gif" width="32" height="32" alt="/" /></td></tr><tr><td align="right" valign="top" colspan="2"> 聽 </td><td class="lm">Last update: 2006-01-04 06:36 聽聽 [from the cache]<br />漏2003-2020 <a href="http://blog.jasper.es/"><span itemprop="editor">Jasper Spaans</span></a>|hosted at <a href="https://www.digitalocean.com/?refcode=9a8e99d24cf9">Digital Ocean</a> and my Meterkast|<a href="http://blog.jasper.es/categories.html#lkml-ref">Read the blog</a></td><td>聽</td></tr></table><script language="javascript" src="/js/styleswitcher.js" type="text/javascript"></script></body></html>