iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/io_uring
History
Savino Dicanosa 7b100a45dc io_uring/rsrc: fix null-ptr-deref in io_file_bitmap_get() 
commit 02a4d923e4400a36d340ea12d8058f69ebf3a383 upstream.

When fixed files are unregistered, file_alloc_end and alloc_hint
are not cleared. This can later cause a NULL pointer dereference in
io_file_bitmap_get() if auto index selection is enabled via
IORING_FILE_INDEX_ALLOC:

[    6.519129] BUG: kernel NULL pointer dereference, address: 0000000000000000
[...]
[    6.541468] RIP: 0010:_find_next_zero_bit+0x1a/0x70
[...]
[    6.560906] Call Trace:
[    6.561322]  <TASK>
[    6.561672]  io_file_bitmap_get+0x38/0x60
[    6.562281]  io_fixed_fd_install+0x63/0xb0
[    6.562851]  ? __pfx_io_socket+0x10/0x10
[    6.563396]  io_socket+0x93/0xf0
[    6.563855]  ? __pfx_io_socket+0x10/0x10
[    6.564411]  io_issue_sqe+0x5b/0x3d0
[    6.564914]  io_submit_sqes+0x1de/0x650
[    6.565452]  __do_sys_io_uring_enter+0x4fc/0xb20
[    6.566083]  ? __do_sys_io_uring_register+0x11e/0xd80
[    6.566779]  do_syscall_64+0x3c/0x90
[    6.567247]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
[...]

To fix the issue, set file alloc range and alloc_hint to zero after
file tables are freed.

Cc: stable@vger.kernel.org
Fixes: 4278a0deb1f6 ("io_uring: defer alloc_hint update to io_file_bitmap_set()")
Signed-off-by: Savino Dicanosa <sd7.dev@pm.me>
[axboe: add explicit bitmap == NULL check as well]
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-03-30 12:49:25 +02:00
..
advise.c
io_uring: make io_kiocb_to_cmd() typesafe
2022-08-12 17:01:00 -06:00
advise.h
…
alloc_cache.h
…
cancel.c
io_uring/cancel: re-grab ctx mutex after finishing wait
2023-01-12 12:02:38 +01:00
cancel.h
…
epoll.c
io_uring: make io_kiocb_to_cmd() typesafe
2022-08-12 17:01:00 -06:00
epoll.h
…
fdinfo.c
io_uring/fdinfo: include locked hash table in fdinfo output
2023-01-18 11:58:15 +01:00
fdinfo.h
…
filetable.c
io_uring/rsrc: fix null-ptr-deref in io_file_bitmap_get()
2023-03-30 12:49:25 +02:00
filetable.h
io_uring: kill hot path fixed file bitmap debug checks
2022-10-16 17:07:53 -06:00
fs.c
io_uring: make io_kiocb_to_cmd() typesafe
2022-08-12 17:01:00 -06:00
fs.h
…
io_uring.c
io_uring: fix fget leak when fs don't support nowait buffered read
2023-03-10 09:34:04 +01:00
io_uring.h
io_uring: mark task TASK_RUNNING before handling resume/task work
2023-03-10 09:34:07 +01:00
io-wq.c
io_uring/io-wq: only free worker if it was allocated for creation
2023-01-18 11:58:33 +01:00
io-wq.h
…
kbuf.c
io_uring: fix size calculation when registering buf ring
2023-03-11 13:55:30 +01:00
kbuf.h
io_uring: allow buffer recycling in READV
2022-09-21 10:30:43 -06:00
Makefile
…
msg_ring.c
io_uring/msg_ring: let target know allocated index
2023-03-22 13:34:06 +01:00
msg_ring.h
…
net.c
io_uring/net: avoid sending -ECONNABORTED on repeated connection requests
2023-03-30 12:49:25 +02:00
net.h
io_uring/net: zerocopy sendmsg
2022-09-21 13:15:02 -06:00
nop.c
…
nop.h
…
notif.c
io_uring/net: introduce IORING_SEND_ZC_REPORT_USAGE flag
2022-12-31 13:33:11 +01:00
notif.h
io_uring/net: introduce IORING_SEND_ZC_REPORT_USAGE flag
2022-12-31 13:33:11 +01:00
opdef.c
io_uring: dont remove file from msg_ring reqs
2022-12-31 13:33:12 +01:00
opdef.h
io_uring: dont remove file from msg_ring reqs
2022-12-31 13:33:12 +01:00
openclose.c
io_uring: make io_kiocb_to_cmd() typesafe
2022-08-12 17:01:00 -06:00
openclose.h
…
poll.c
io_uring/poll: allow some retries for poll triggering spuriously
2023-03-11 13:55:43 +01:00
poll.h
io_uring/poll: allow some retries for poll triggering spuriously
2023-03-11 13:55:43 +01:00
refs.h
…
rsrc.c
io_uring/rsrc: fix null-ptr-deref in io_file_bitmap_get()
2023-03-30 12:49:25 +02:00
rsrc.h
io_uring: remove FFS_SCM
2022-10-16 17:07:12 -06:00
rw.c
use less confusing names for iov_iter direction initializers
2023-02-09 11:28:04 +01:00
rw.h
io_uring/rw: don't lose partial IO result on fail
2022-09-21 13:15:02 -06:00
slist.h
…
splice.c
io_uring: make io_kiocb_to_cmd() typesafe
2022-08-12 17:01:00 -06:00
splice.h
…
sqpoll.c
…
sqpoll.h
…
statx.c
io_uring: make io_kiocb_to_cmd() typesafe
2022-08-12 17:01:00 -06:00
statx.h
…
sync.c
io_uring: make io_kiocb_to_cmd() typesafe
2022-08-12 17:01:00 -06:00
sync.h
…
tctx.c
io_uring: remove io_register_submitter
2022-10-07 12:25:30 -06:00
tctx.h
io_uring: simplify __io_uring_add_tctx_node
2022-10-07 12:25:30 -06:00
timeout.c
io_uring: remove io_req_tw_post_queue
2023-02-01 08:34:41 +01:00
timeout.h
io_uring: remove unused return from io_disarm_next
2022-09-21 13:15:01 -06:00
uring_cmd.c
io_uring/uring_cmd: ensure that device supports IOPOLL
2023-03-17 08:50:14 +01:00
uring_cmd.h
…
xattr.c
__io_setxattr(): constify path
2022-09-01 17:39:05 -04:00
xattr.h
…