kernel/git/stable/linux.git/fs/io_uring.c, branch linux-5.9.y

io_uring: fix recvmsg setup with compat buf-select

2020-12-11T12:22:09+00:00

commit 2d280bc8930ba9ed1705cfd548c6c8924949eaf1 upstream. __io_compat_recvmsg_copy_hdr() with REQ_F_BUFFER_SELECT reads out iov len but never assigns it to iov/fast_iov, leaving sr->len with garbage. Hopefully, following io_buffer_select() truncates it to the selected buffer size, but the value is still may be under what was specified. Cc: # 5.7 Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman

io_uring: fix shift-out-of-bounds when round up cq size

2020-12-02T07:51:57+00:00

[ Upstream commit eb2667b343361863da7b79be26de641e22844ba0 ] Abaci Fuzz reported a shift-out-of-bounds BUG in io_uring_create(): [ 59.598207] UBSAN: shift-out-of-bounds in ./include/linux/log2.h:57:13 [ 59.599665] shift exponent 64 is too large for 64-bit type 'long unsigned int' [ 59.601230] CPU: 0 PID: 963 Comm: a.out Not tainted 5.10.0-rc4+ #3 [ 59.602502] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 59.603673] Call Trace: [ 59.604286] dump_stack+0x107/0x163 [ 59.605237] ubsan_epilogue+0xb/0x5a [ 59.606094] __ubsan_handle_shift_out_of_bounds.cold+0xb2/0x20e [ 59.607335] ? lock_downgrade+0x6c0/0x6c0 [ 59.608182] ? rcu_read_lock_sched_held+0xaf/0xe0 [ 59.609166] io_uring_create.cold+0x99/0x149 [ 59.610114] io_uring_setup+0xd6/0x140 [ 59.610975] ? io_uring_create+0x2510/0x2510 [ 59.611945] ? lockdep_hardirqs_on_prepare+0x286/0x400 [ 59.613007] ? syscall_enter_from_user_mode+0x27/0x80 [ 59.614038] ? trace_hardirqs_on+0x5b/0x180 [ 59.615056] do_syscall_64+0x2d/0x40 [ 59.615940] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 59.617007] RIP: 0033:0x7f2bb8a0b239 This is caused by roundup_pow_of_two() if the input entries larger enough, e.g. 2^32-1. For sq_entries, it will check first and we allow at most IORING_MAX_ENTRIES, so it is okay. But for cq_entries, we do round up first, that may overflow and truncate it to 0, which is not the expected behavior. So check the cq size first and then do round up. Fixes: 88ec3211e463 ("io_uring: round-up cq size before comparing with rounded sq size") Reported-by: Abaci Fuzz Signed-off-by: Joseph Qi Reviewed-by: Stefano Garzarella Signed-off-by: Jens Axboe Signed-off-by: Sasha Levin

io_uring: handle -EOPNOTSUPP on path resolution

2020-12-02T07:51:50+00:00

[ Upstream commit 944d1444d53f5a213457e5096db370cfd06923d4 ] Any attempt to do path resolution on /proc/self from an async worker will yield -EOPNOTSUPP. We can safely do that resolution from the task itself, and without blocking, so retry it from there. Ideally io_uring would know this upfront and not have to go through the worker thread to find out, but that doesn't currently seem feasible. Signed-off-by: Jens Axboe Signed-off-by: Sasha Levin

io_uring: fix ITER_BVEC check

2020-12-02T07:51:46+00:00

commit 9c3a205c5ffa36e96903c2e37eb5f41c0f03c43e upstream. iov_iter::type is a bitmask that also keeps direction etc., so it shouldn't be directly compared against ITER_*. Use proper helper. Fixes: ff6165b2d7f6 ("io_uring: retain iov_iter state over io_read/io_write calls") Reported-by: David Howells Signed-off-by: Pavel Begunkov Cc: # 5.9 Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman

io_uring: order refnode recycling

2020-12-02T07:51:43+00:00

commit e297822b20e7fe683e107aea46e6402adcf99c70 upstream. Don't recycle a refnode until we're done with all requests of nodes ejected before. Signed-off-by: Pavel Begunkov Cc: stable@vger.kernel.org # v5.7+ Signed-off-by: Jens Axboe Signed-off-by: Pavel Begunkov Signed-off-by: Greg Kroah-Hartman

io_uring: get an active ref_node from files_data

2020-12-02T07:51:43+00:00

commit 1e5d770bb8a23dd01e28e92f4fb0b1093c8bdbe6 upstream. An active ref_node always can be found in ctx->files_data, it's much safer to get it this way instead of poking into files_data->ref_list. Signed-off-by: Pavel Begunkov Cc: stable@vger.kernel.org # v5.7+ Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman

io_uring: don't double complete failed reissue request

2020-11-24T12:39:13+00:00

commit c993df5a688975bf9ce899706ca13d2bc8d6be25 upstream. Zorro reports that an xfstest test case is failing, and it turns out that for the reissue path we can potentially issue a double completion on the request for the failure path. There's an issue around the retry as well, but for now, at least just make sure that we handle the error path correctly. Cc: stable@vger.kernel.org Fixes: b63534c41e20 ("io_uring: re-issue block requests that failed because of resources") Reported-by: Zorro Lang Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman

io_uring: round-up cq size before comparing with rounded sq size

2020-11-18T18:22:28+00:00

commit 88ec3211e46344a7d10cf6cb5045f839f7785f8e upstream. If an application specifies IORING_SETUP_CQSIZE to set the CQ ring size to a specific size, we ensure that the CQ size is at least that of the SQ ring size. But in doing so, we compare the already rounded up to power of two SQ size to the as-of yet unrounded CQ size. This means that if an application passes in non power of two sizes, we can return -EINVAL when the final value would've been fine. As an example, an application passing in 100/100 for sq/cq size should end up with 128 for both. But since we round the SQ size first, we compare the CQ size of 100 to 128, and return -EINVAL as that is too small. Cc: stable@vger.kernel.org Fixes: 33a107f0a1b8 ("io_uring: allow application controlled CQ ring size") Reported-by: Dan Melnic Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman

io_uring: ensure consistent view of original task ->mm from SQPOLL

2020-11-18T18:22:06+00:00

[ Upstream commit 4b70cf9dea4cd239b425f3282fa56ce19e234c8a ] Ensure we get a valid view of the task mm, by using task_lock() when attempting to grab the original task mm. Reported-by: syzbot+b57abf7ee60829090495@syzkaller.appspotmail.com Fixes: 2aede0e417db ("io_uring: stash ctx task reference for SQPOLL") Signed-off-by: Jens Axboe Signed-off-by: Sasha Levin

io_uring: fix link lookup racing with link timeout

2020-11-10T11:39:10+00:00

commit 9a472ef7a3690ac0b77ebfb04c88fa795de2adea upstream. We can't just go over linked requests because it may race with linked timeouts. Take ctx->completion_lock in that case. Cc: stable@vger.kernel.org # v5.7+ Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman