Darrick J. Wong b71dbf1032 vfs: cap dedupe request structure size at PAGE_SIZE
Kirill A Shutemov reports that the kernel doesn't try to cap dest_count
in any way, and uses the number to allocate kernel memory.  This causes
high order allocation warnings in the kernel log if someone passes in a
big enough value.  We should clamp the allocation at PAGE_SIZE to avoid
stressing the VM.

The two existing users of the dedupe ioctl never send more than 120
requests, so we can safely clamp dest_range at PAGE_SIZE, because with
4k pages we can handle up to 127 dedupe candidates.  Given the max
extent length of 16MB, we can end up doing 2GB of IO which is plenty.

[ Note: the "offsetof()" can't overflow, because 'count' is just a
  16-bit integer.  That's not obvious in the limited context of the
  patch, so I'm noting it here because it made me go look.  - Linus ]

Reported-by: "Kirill A. Shutemov" <kirill@shutemov.name>
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2016-09-15 13:29:52 -07:00
..
2016-05-20 17:58:30 -07:00
2016-08-07 10:03:31 -04:00
2016-09-05 13:55:20 +02:00
2016-05-23 17:04:14 -07:00
2016-07-27 09:53:35 -07:00
2016-06-07 22:07:09 -04:00
2016-07-28 17:38:16 -07:00
2016-08-07 10:13:14 -04:00
2016-08-04 19:59:06 -04:00
2016-06-20 17:11:29 -04:00
2016-07-01 10:24:18 -04:00
2016-06-21 09:23:11 +10:00
2016-08-07 10:03:31 -04:00
2016-08-07 10:13:14 -04:00
2016-08-26 17:39:35 -07:00
2016-07-26 16:19:19 -07:00
2016-08-07 10:03:31 -04:00