Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
io_uring/kbuf: use WRITE_ONCE() for userspace-shared buffer ring fields
buf->addr and buf->len reside in memory shared with userspace. They
should be written with WRITE_ONCE() to guarantee atomic stores and
prevent tearing or other unsafe compiler optimizations.
Signed-off-by: Joanne Koong <joannelkoong@gmail.com>
Cc: Caleb Sander Mateos <csander@purestorage.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
authored by
Joanne Koong
and committed by
Jens Axboe
a4c694bf
78385c72
+4
-4
+4
-4
io_uring/kbuf.c
+4
-4
io_uring/kbuf.c
···
44
44
buf_len -= this_len;
45
45
/* Stop looping for invalid buffer length of 0 */
46
46
if (buf_len || !this_len) {
47
-
buf->addr = READ_ONCE(buf->addr) + this_len;
48
-
buf->len = buf_len;
47
+
WRITE_ONCE(buf->addr, READ_ONCE(buf->addr) + this_len);
48
+
WRITE_ONCE(buf->len, buf_len);
49
49
return false;
50
50
}
51
-
buf->len = 0;
51
+
WRITE_ONCE(buf->len, 0);
52
52
bl->head++;
53
53
len -= this_len;
54
54
}
···
291
291
arg->partial_map = 1;
292
292
if (iov != arg->iovs)
293
293
break;
294
-
buf->len = len;
294
+
WRITE_ONCE(buf->len, len);
295
295
}
296
296
}
297
297