Patch "splice: Apply generic position and size checks to each write" has been added to the 3.14-stable tree

This is a note to let you know that I've just added the patch titled

splice: Apply generic position and size checks to each write

to the 3.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
splice-apply-generic-position-and-size-checks-to-each-write.patch
and it can be found in the queue-3.14 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Ben Hutchings <[email protected]>
Date: Thu, 29 Jan 2015 02:50:33 +0000
Subject: splice: Apply generic position and size checks to each write

From: Ben Hutchings <[email protected]>

commit 894c6350eaad7e613ae267504014a456e00a3e2a from the 3.2-stable branch.

We need to check the position and size of file writes against various limits, using generic_write_check(). This was not being done for the splice write path. It was fixed upstream by commit 8d0207652cbe ("->splice_write() via ->write_iter()") but we can't apply that.

CVE-2014-7822

---
 fs/ocfs2/file.c |    8 ++++++--
 fs/splice.c     |    8 ++++++--
 2 files changed, 12 insertions(+), 4 deletions(-)

@@ -2478,9 +2478,7 @@ static ssize_t ocfs2_file_splice_write(s
 	struct address_space *mapping = out->f_mapping;
 	struct inode *inode = mapping->host;
 	struct splice_desc sd = {
-		.total_len = len,
 		.flags = flags,
-		.pos = *ppos,
 		.u.file = out,
 	};
 

@@ -2490,6 +2488,12 @@ static ssize_t ocfs2_file_splice_write(s
 			out->f_path.dentry->d_name.len,
 			out->f_path.dentry->d_name.name, len);
 
+	ret = generic_write_checks(out, ppos, &len, 0);
+	if (ret)
+		return ret;
+	sd.total_len = len;
+	sd.pos = *ppos;
+
 	pipe_lock(pipe);
 
 	splice_from_pipe_begin(&sd);

@@ -1012,13 +1012,17 @@ generic_file_splice_write(struct pipe_in
 	struct address_space *mapping = out->f_mapping;
 	struct inode *inode = mapping->host;
 	struct splice_desc sd = {
-		.total_len = len,
 		.flags = flags,
-		.pos = *ppos,
 		.u.file = out,
 	};
 	ssize_t ret;
 
+	ret = generic_write_checks(out, ppos, &len, S_ISBLK(inode->i_mode));
+	if (ret)
+		return ret;
+	sd.total_len = len;
+	sd.pos = *ppos;
+
 	pipe_lock(pipe);
 
 	splice_from_pipe_begin(&sd);

Patches currently in stable-queue which might be from [email protected] are

queue-3.14/config-enable-need_dma_map_state-by-default-when-swiotlb-is-selected.patch queue-3.14/splice-apply-generic-position-and-size-checks-to-each-write.patch