io_uring: fix dead-hung for non-iter fixed rw (311ae9e1) · Commits · 戴 / test

Read/write requests to devices without implemented read/write_iter using fixed buffers can cause general protection fault, which totally hangs a machine. io_import_fixed() initialises iov_iter with bvec, but loop_rw_iter() accesses it as iovec, dereferencing random address. kmap() page by page in this case Cc: stable@vger.kernel.org Signed-off-by:

Pavel Begunkov <asml.silence@gmail.com> Signed-off-by:

Jens Axboe <axboe@kernel.dk>

fs/io_uring.c

+14 −1

Original line number	Diff line number	Diff line
		@@ -1622,9 +1622,19 @@ static ssize_t loop_rw_iter(int rw, struct file file, struct kiocb kiocb,
		return -EAGAIN;

		while (iov_iter_count(iter)) {
		struct iovec iovec = iov_iter_iovec(iter);
		struct iovec iovec;
		ssize_t nr;

		if (!iov_iter_is_bvec(iter)) {
		iovec = iov_iter_iovec(iter);
		} else {
		/* fixed buffers import bvec */
		iovec.iov_base = kmap(iter->bvec->bv_page)
		+ iter->iov_offset;
		iovec.iov_len = min(iter->count,
		iter->bvec->bv_len - iter->iov_offset);
		}

		if (rw == READ) {
		nr = file->f_op->read(file, iovec.iov_base,
		iovec.iov_len, &kiocb->ki_pos);
		@@ -1633,6 +1643,9 @@ static ssize_t loop_rw_iter(int rw, struct file file, struct kiocb kiocb,
		iovec.iov_len, &kiocb->ki_pos);
		}

		if (iov_iter_is_bvec(iter))
		kunmap(iter->bvec->bv_page);

		if (nr < 0) {
		if (!ret)
		ret = nr;

Admin message