iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/fs
History
Pavel Begunkov 51520426f4 io_uring: handle setup-failed ctx in kill_timeouts 
general protection fault, probably for non-canonical address
	0xdffffc0000000018: 0000 [#1] KASAN: null-ptr-deref
	in range [0x00000000000000c0-0x00000000000000c7]
RIP: 0010:io_commit_cqring+0x37f/0xc10 fs/io_uring.c:1318
Call Trace:
 io_kill_timeouts+0x2b5/0x320 fs/io_uring.c:8606
 io_ring_ctx_wait_and_kill+0x1da/0x400 fs/io_uring.c:8629
 io_uring_create fs/io_uring.c:9572 [inline]
 io_uring_setup+0x10da/0x2ae0 fs/io_uring.c:9599
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xae

It can get into wait_and_kill() before setting up ctx->rings, and hence
io_commit_cqring() fails. Mimic poll cancel and do it only when we
completed events, there can't be any requests if it failed before
initialising rings.

Fixes: 80c4cbdb5ee60 ("io_uring: do post-completion chore on t-out cancel")
Reported-by: syzbot+0e905eb8228070c457a0@syzkaller.appspotmail.com
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/660261a48f0e7abf260c8e43c87edab3c16736fa.1617014345.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2021-03-29 06:48:26 -06:00
..
9p
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2021-02-27 08:07:12 -08:00
adfs
fs: make helpers idmap mount aware
2021-01-24 14:27:20 +01:00
affs
idmapped-mounts-v5.12
2021-02-23 13:39:45 -08:00
afs
idmapped-mounts-v5.12
2021-02-23 13:39:45 -08:00
autofs
fs: make helpers idmap mount aware
2021-01-24 14:27:20 +01:00
befs
[PATCH] reduce boilerplate in fsid handling
2020-09-18 16:45:50 -04:00
bfs
fs: make helpers idmap mount aware
2021-01-24 14:27:20 +01:00
btrfs
for-5.12-rc1-tag
2021-03-05 12:21:14 -08:00
cachefiles
idmapped-mounts-v5.12
2021-02-23 13:39:45 -08:00
ceph
idmapped-mounts-v5.12
2021-02-23 13:39:45 -08:00
cifs
cifs/smb3 fixes including improvements to mode bit conversion when using cifsacl mount option, new mount options for controlling attribute caching, improvements to crediting and reconnect, improved debugging
2021-02-26 14:09:41 -08:00
coda
fs: make helpers idmap mount aware
2021-01-24 14:27:20 +01:00
configfs
fs: make helpers idmap mount aware
2021-01-24 14:27:20 +01:00
cramfs
cramfs: use %pD instead of messing with file_dentry()->d_name
2021-01-05 23:02:47 -05:00
crypto
inode: make init and permission helpers idmapped mount aware
2021-01-24 14:27:16 +01:00
debugfs
Driver core / debugfs update for 5.12-rc1
2021-02-24 10:13:55 -08:00
devpts
…
dlm
fs: dlm: check on existing node address
2020-11-10 12:14:20 -06:00
ecryptfs
idmapped-mounts-v5.12
2021-02-23 13:39:45 -08:00
efivarfs
fs: make helpers idmap mount aware
2021-01-24 14:27:20 +01:00
efs
[PATCH] reduce boilerplate in fsid handling
2020-09-18 16:45:50 -04:00
erofs
block-5.12-2021-02-27
2021-02-28 11:23:38 -08:00
exfat
idmapped-mounts-v5.12
2021-02-23 13:39:45 -08:00
exportfs
exportfs: Add a function to return the raw output from fh_to_dentry()
2020-12-09 09:39:38 -05:00
ext2
fs: make helpers idmap mount aware
2021-01-24 14:27:20 +01:00
ext4
block-5.12-2021-02-27
2021-02-28 11:23:38 -08:00
f2fs
block-5.12-2021-02-27
2021-02-28 11:23:38 -08:00
fat
idmapped-mounts-v5.12
2021-02-23 13:39:45 -08:00
freevxfs
…
fscache
…
fuse
mm/filemap: remove unused parameter and change to void type for replace_page_cache_page()
2021-02-24 13:38:27 -08:00
gfs2
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2021-02-27 08:07:12 -08:00
hfs
fs: make helpers idmap mount aware
2021-01-24 14:27:20 +01:00
hfsplus
idmapped-mounts-v5.12
2021-02-23 13:39:45 -08:00
hostfs
idmapped-mounts-v5.12
2021-02-23 13:39:45 -08:00
hpfs
fs: make helpers idmap mount aware
2021-01-24 14:27:20 +01:00
hugetlbfs
hugetlbfs: remove unneeded return value of hugetlb_vmtruncate()
2021-02-24 13:38:35 -08:00
iomap
More new code for 5.12:
2021-02-28 11:45:25 -08:00
isofs
isofs: handle large user and group ID
2021-02-03 19:05:52 +01:00
jbd2
block: use an on-stack bio in blkdev_issue_flush
2021-01-27 09:51:48 -07:00
jffs2
idmapped-mounts-v5.12
2021-02-23 13:39:45 -08:00
jfs
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2021-02-27 08:07:12 -08:00
kernfs
idmapped-mounts-v5.12
2021-02-23 13:39:45 -08:00
lockd
SUNRPC: Make trace_svc_process() display the RPC procedure symbolically
2021-01-25 09:36:23 -05:00
minix
fs: make helpers idmap mount aware
2021-01-24 14:27:20 +01:00
nfs
block-5.12-2021-02-27
2021-02-28 11:23:38 -08:00
nfs_common
NFSv4_2: SSC helper should use its own config.
2021-01-28 10:55:37 -05:00
nfsd
idmapped-mounts-v5.12
2021-02-23 13:39:45 -08:00
nilfs2
idmapped-mounts-v5.12
2021-02-23 13:39:45 -08:00
nls
…
notify
idmapped-mounts-v5.12
2021-02-23 13:39:45 -08:00
ntfs
ntfs: check for valid standard information attribute
2021-02-24 13:38:26 -08:00
ocfs2
ocfs2: simplify the calculation of variables
2021-02-24 13:38:26 -08:00
omfs
fs: make helpers idmap mount aware
2021-01-24 14:27:20 +01:00
openpromfs
…
orangefs
idmapped-mounts-v5.12
2021-02-23 13:39:45 -08:00
overlayfs
idmapped-mounts-v5.12
2021-02-23 13:39:45 -08:00
proc
io_uring-worker.v3-2021-02-25
2021-02-27 08:29:02 -08:00
pstore
pstore fixes for v5.12-rc2
2021-03-05 17:21:25 -08:00
qnx4
[PATCH] reduce boilerplate in fsid handling
2020-09-18 16:45:50 -04:00
qnx6
[PATCH] reduce boilerplate in fsid handling
2020-09-18 16:45:50 -04:00
quota
quota: Fix memory leak when handling corrupted quota file
2021-01-05 14:42:18 +01:00
ramfs
ramfs: support O_TMPFILE
2021-02-24 13:38:26 -08:00
reiserfs
idmapped-mounts-v5.12
2021-02-23 13:39:45 -08:00
romfs
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2020-10-24 12:26:05 -07:00
squashfs
squashfs: add more sanity checks in xattr id lookup
2021-02-09 17:26:44 -08:00
sysfs
sysfs: Support zapping of binary attr mmaps
2021-01-12 14:26:31 +01:00
sysv
fs: make helpers idmap mount aware
2021-01-24 14:27:20 +01:00
tracefs
fs: make helpers idmap mount aware
2021-01-24 14:27:20 +01:00
ubifs
idmapped-mounts-v5.12
2021-02-23 13:39:45 -08:00
udf
idmapped-mounts-v5.12
2021-02-23 13:39:45 -08:00
ufs
fs: make helpers idmap mount aware
2021-01-24 14:27:20 +01:00
unicode
unicode: Add utf8_casefold_hash
2020-09-10 14:03:31 -07:00
vboxsf
fs: make helpers idmap mount aware
2021-01-24 14:27:20 +01:00
verity
idmapped-mounts-v5.12
2021-02-23 13:39:45 -08:00
xfs
More new code for 5.12:
2021-02-28 11:45:25 -08:00
zonefs
idmapped-mounts-v5.12
2021-02-23 13:39:45 -08:00
aio.c
Merge branch 'akpm' (patches from Andrew)
2020-12-15 12:53:37 -08:00
anon_inodes.c
fs: anon_inodes: rephrase to appropriate kernel-doc
2021-01-15 12:17:25 -05:00
attr.c
ima: handle idmapped mounts
2021-01-24 14:27:20 +01:00
bad_inode.c
fs: make helpers idmap mount aware
2021-01-24 14:27:20 +01:00
binfmt_aout.c
…
binfmt_elf_fdpic.c
Merge branch 'parisc-5.12-1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux
2021-02-21 13:20:41 -08:00
binfmt_elf.c
Merge branch 'parisc-5.12-1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux
2021-02-21 13:20:41 -08:00
binfmt_em86.c
…
binfmt_flat.c
binfmt_flat: revert "binfmt_flat: don't offset the data start"
2020-08-24 08:49:13 +10:00
binfmt_misc.c
binfmt_misc: pass binfmt_misc flags to the interpreter
2021-02-15 18:28:30 +01:00
binfmt_script.c
…
block_dev.c
block-5.12-2021-02-27
2021-02-28 11:23:38 -08:00
buffer.c
fs: buffer: use raw page_memcg() on locked page
2021-02-24 13:38:30 -08:00
char_dev.c
…
compat_binfmt_elf.c
get rid of COMPAT_ELF_EXEC_PAGESIZE
2021-01-06 08:42:51 -05:00
coredump.c
fs/coredump: use kmap_local_page()
2021-02-26 09:41:05 -08:00
d_path.c
fs: fix NULL dereference due to data race in prepend_path()
2020-10-14 14:54:45 -07:00
dax.c
mm: provide a saner PTE walking API for modules
2021-02-09 07:05:44 -05:00
dcache.c
fs: delete repeated words in comments
2021-02-24 13:38:26 -08:00
direct-io.c
block-5.12-2021-02-27
2021-02-28 11:23:38 -08:00
drop_caches.c
…
eventfd.c
eventfd: Export eventfd_ctx_do_read()
2020-11-15 09:49:10 -05:00
eventpoll.c
kcmp: Support selection of SYS_kcmp without CHECKPOINT_RESTORE
2021-02-16 09:59:41 +01:00
exec.c
fs: delete repeated words in comments
2021-02-24 13:38:26 -08:00
fcntl.c
idmapped-mounts-v5.12
2021-02-23 13:39:45 -08:00
fhandle.c
fs: delete repeated words in comments
2021-02-24 13:38:26 -08:00
file_table.c
epoll: take epitem list out of struct file
2020-10-25 20:02:08 -04:00
file.c
fs: provide locked helper variant of close_fd_get_file()
2021-02-01 10:02:42 -07:00
filesystems.c
…
fs_context.c
treewide: Use fallthrough pseudo-keyword
2020-08-23 17:36:59 -05:00
fs_parser.c
fs_parse: mark fs_param_bad_value() as static
2020-10-13 18:38:27 -07:00
fs_pin.c
…
fs_struct.c
…
fs_types.c
…
fs-writeback.c
fs: improve comments for writeback_single_inode()
2021-01-13 17:26:50 +01:00
fsopen.c
treewide: Use fallthrough pseudo-keyword
2020-08-23 17:36:59 -05:00
init.c
init: handle idmapped mounts
2021-01-24 14:27:19 +01:00
inode.c
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2021-02-27 08:07:12 -08:00
internal.h
idmapped-mounts-v5.12
2021-02-23 13:39:45 -08:00
io_uring.c
io_uring: handle setup-failed ctx in kill_timeouts
2021-03-29 06:48:26 -06:00
io-wq.c
io_uring: handle signals for IO threads like a normal thread
2021-03-27 14:09:07 -06:00
io-wq.h
io_uring: remove structures from include/linux/io_uring.h
2021-03-18 09:44:35 -06:00
ioctl.c
…
Kconfig
Highlights:
2021-02-21 10:22:20 -08:00
Kconfig.binfmt
Merge branch 'work.elf-compat' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2021-02-21 09:29:23 -08:00
kernel_read_file.c
fs/kernel_file_read: Add "offset" arg for partial reads
2020-10-05 13:37:04 +02:00
libfs.c
idmapped-mounts-v5.12
2021-02-23 13:39:45 -08:00
locks.c
Merge branch 'exec-for-v5.11' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace
2020-12-15 19:29:43 -08:00
Makefile
fs: Remove dcookies support
2021-01-29 10:06:46 +05:30
mbcache.c
…
mount.h
mount: make {lock,unlock}_mount_hash() static
2021-01-24 14:29:34 +01:00
mpage.c
block: Add bio_max_segs
2021-02-26 15:49:51 -07:00
namei.c
idmapped-mounts-v5.12
2021-02-23 13:39:45 -08:00
namespace.c
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2021-02-27 08:07:12 -08:00
no-block.c
…
nsfs.c
…
open.c
idmapped-mounts-v5.12
2021-02-23 13:39:45 -08:00
pipe.c
fs: delete repeated words in comments
2021-02-24 13:38:26 -08:00
pnode.c
…
pnode.h
fs/namespace.c: WARN if mnt_count has become negative
2020-12-10 17:33:17 -05:00
posix_acl.c
fs: make helpers idmap mount aware
2021-01-24 14:27:20 +01:00
proc_namespace.c
fs: introduce MOUNT_ATTR_IDMAP
2021-01-24 14:43:45 +01:00
read_write.c
teach sendfile(2) to handle send-to-pipe directly
2021-01-25 23:29:36 -05:00
readdir.c
…
remap_range.c
ioctl: handle idmapped mounts
2021-01-24 14:27:19 +01:00
select.c
poll: fix performance regression due to out-of-line __put_user()
2021-01-08 11:06:29 -08:00
seq_file.c
fs: fix kernel-doc markups
2021-01-21 14:06:00 -07:00
signalfd.c
treewide: Use fallthrough pseudo-keyword
2020-08-23 17:36:59 -05:00
splice.c
for-5.12/block-2021-02-17
2021-02-21 11:02:48 -08:00
stack.c
…
stat.c
fs: make helpers idmap mount aware
2021-01-24 14:27:20 +01:00
statfs.c
s390,alpha: switch to 64-bit ino_t
2021-02-13 17:17:53 +01:00
super.c
It has been a relatively quiet cycle in docsland.
2021-02-22 10:57:46 -08:00
sync.c
…
timerfd.c
…
userfaultfd.c
userfaultfd: use secure anon inodes for userfaultfd
2021-01-14 17:40:57 -05:00
utimes.c
utimes: handle idmapped mounts
2021-01-24 14:27:18 +01:00
xattr.c
namei: handle idmapped mounts in may_*() helpers
2021-01-24 14:27:17 +01:00