commit 6f3caa3fe3e31a2d6662250325542a37cb3ddd8d
author Linus Torvalds <torvalds@linux-foundation.org> Mon May 21 16:06:20 2012 -0700
committer Michał Orynicz <michal.orynicz@sonymobile.com> Fri Jul 22 11:46:13 2016 +0200
tree eee06656af40cb001a5d4d266ce022663b528269
parent b341c1681eca7fb280096b426bff9e37b979419b

vfs: make AIO use the proper rw_verify_area() area helpers

We had for some reason overlooked the AIO interface, and it didn't use
the proper rw_verify_area() helper function that checks (for example)
mandatory locking on the file, and that the size of the access doesn't
cause us to overflow the provided offset limits etc.

Instead, AIO did just the security_file_permission() thing (that
rw_verify_area() also does) directly.

This fixes it to do all the proper helper functions, which not only
means that now mandatory file locking works with AIO too, we can
actually remove lines of code.

Reported-by: Manish Honap <manish_honap_vit@yahoo.co.in>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
(cherry picked from commit a70b52ec1aaeaf60f4739edb1b422827cb6f3893)

Conflicts:
	fs/aio.c

Issue: KIONE-3528
Change-Id: I16f425d86e886a50b20fd397ce6f4f8cf1d60dd7

fs/aio.c

diff --git a/fs/aio.c b/fs/aio.c
index 109e896..4afba4b 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -968,25 +968,37 @@
 	if (ret < 0)
 		return ret;
 
-	/* ki_nbytes now reflect bytes instead of segs */
+	ret = rw_verify_area(rw, kiocb->ki_filp, &kiocb->ki_pos, ret);
+	if (ret < 0)
+		return ret;
+
+	kiocb->ki_nr_segs = kiocb->ki_nbytes;
+	kiocb->ki_cur_seg = 0;
+	/* ki_nbytes/left now reflect bytes instead of segs */
 	kiocb->ki_nbytes = ret;
-	return 0;
+	kiocb->ki_left = ret;
+	return ret;
 }
 
-static ssize_t aio_setup_single_vector(int rw, struct kiocb *kiocb)
+static ssize_t aio_setup_single_vector(int type, struct file * file, struct kiocb *kiocb)
 {
-	size_t len = kiocb->ki_nbytes;
+	int bytes;
 
-	if (len > MAX_RW_COUNT)
-		len = MAX_RW_COUNT;
+	bytes = rw_verify_area(type, file, &kiocb->ki_pos, kiocb->ki_left);
+	if (bytes < 0)
+		return bytes;
 
-	if (unlikely(!access_ok(!rw, kiocb->ki_buf, len)))
+	if (bytes > MAX_RW_COUNT)
+		bytes = MAX_RW_COUNT;
+
+	if (unlikely(!access_ok(!type, kiocb->ki_buf, bytes)))
                 return -EFAULT;
 
 	kiocb->ki_iovec = &kiocb->ki_inline_vec;
 	kiocb->ki_iovec->iov_base = kiocb->ki_buf;
-	kiocb->ki_iovec->iov_len = len;
+	kiocb->ki_iovec->iov_len = bytes;
 	kiocb->ki_nr_segs = 1;
+	kiocb->ki_cur_seg = 0;
 	return 0;
 }
 
@@ -1027,7 +1039,7 @@
 		ret = (req->ki_opcode == IOCB_CMD_PREADV ||
 		       req->ki_opcode == IOCB_CMD_PWRITEV)
 			? aio_setup_vectored_rw(rw, req, compat)
-			: aio_setup_single_vector(rw, req);
+		  : aio_setup_single_vector(rw, file, req);
 		if (ret)
 			return ret;