From 93e3d00a9f0158e522cada1088233fad23247882 Mon Sep 17 00:00:00 2001 From: Trond Myklebust Date: Wed, 15 Feb 2006 00:42:26 -0500 Subject: [PATCH] Normal user can panic NFS client with direct I/O (CVE-2006-0555) This is CVE-2006-0555 and SGI bug 946529. A normal user can panic an NFS client and cause a local DoS with 'judicious'(?) use of O_DIRECT. Signed-off-by: Chris Wright --- fs/nfs/direct.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c index 079228817603..3ebb06e62c20 100644 --- a/fs/nfs/direct.c +++ b/fs/nfs/direct.c @@ -106,6 +106,11 @@ nfs_get_user_pages(int rw, unsigned long user_addr, size_t size, result = get_user_pages(current, current->mm, user_addr, page_count, (rw == READ), 0, *pages, NULL); + if (result >= 0 && result < page_count) { + nfs_free_user_pages(*pages, result, 0); + *pages = NULL; + result = -EFAULT; + } up_read(¤t->mm->mmap_sem); } return result; -- cgit v1.2.3