tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

io_uring/kbuf: use READ_ONCE() for userspace-mapped memory

The struct io_uring_buf elements in a buffer ring are in a memory region
accessible from userspace. A malicious/buggy userspace program could
therefore write to them at any time, so they should be accessed with
READ_ONCE() in the kernel. Commit 98b6fa62c84f ("io_uring/kbuf: always
use READ_ONCE() to read ring provided buffer lengths") already switched
the reads of the len field to READ_ONCE(). Do the same for bid and addr.

Signed-off-by: Caleb Sander Mateos <csander@purestorage.com>
Fixes: c7fb19428d67 ("io_uring: add support for ring mapped supplied buffers")
Cc: Joanne Koong <joannelkoong@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

authored by

Caleb Sander Mateos and committed by
Jens Axboe 78385c72 525916ce

+5 -5
+5 -5
io_uring/kbuf.c
··· 44 44 buf_len -= this_len; 45 45 /* Stop looping for invalid buffer length of 0 */ 46 46 if (buf_len || !this_len) { 47 - buf->addr += this_len; 47 + buf->addr = READ_ONCE(buf->addr) + this_len; 48 48 buf->len = buf_len; 49 49 return false; 50 50 } ··· 198 198 if (*len == 0 || *len > buf_len) 199 199 *len = buf_len; 200 200 req->flags |= REQ_F_BUFFER_RING | REQ_F_BUFFERS_COMMIT; 201 - req->buf_index = buf->bid; 201 + req->buf_index = READ_ONCE(buf->bid); 202 202 sel.buf_list = bl; 203 - sel.addr = u64_to_user_ptr(buf->addr); 203 + sel.addr = u64_to_user_ptr(READ_ONCE(buf->addr)); 204 204 205 205 if (io_should_commit(req, issue_flags)) { 206 206 io_kbuf_commit(req, sel.buf_list, *len, 1); ··· 280 280 if (!arg->max_len) 281 281 arg->max_len = INT_MAX; 282 282 283 - req->buf_index = buf->bid; 283 + req->buf_index = READ_ONCE(buf->bid); 284 284 do { 285 285 u32 len = READ_ONCE(buf->len); 286 286 ··· 295 295 } 296 296 } 297 297 298 - iov->iov_base = u64_to_user_ptr(buf->addr); 298 + iov->iov_base = u64_to_user_ptr(READ_ONCE(buf->addr)); 299 299 iov->iov_len = len; 300 300 iov++; 301 301