| Message ID | 9788f6363f9a7fc100f8f9fb7a1a6e11e014cd30.1732576266.git.asml.silence@gmail.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | [1/1] io_uring: sanitise nr_pages for SQ/CQ | expand |
On 11/25/24 23:22, Pavel Begunkov wrote: > WARNING: CPU: 0 PID: 5834 at io_uring/memmap.c:144 io_pin_pages+0x149/0x180 io_uring/memmap.c:144 > CPU: 0 UID: 0 PID: 5834 Comm: syz-executor825 Not tainted 6.12.0-next-20241118-syzkaller #0 > Call Trace: > <TASK> > __io_uaddr_map+0xfb/0x2d0 io_uring/memmap.c:183 > io_rings_map io_uring/io_uring.c:2611 [inline] > io_allocate_scq_urings+0x1c0/0x650 io_uring/io_uring.c:3470 > io_uring_create+0x5b5/0xc00 io_uring/io_uring.c:3692 > io_uring_setup io_uring/io_uring.c:3781 [inline] > ... > </TASK> > > Apparently there is a way to request a large enough CQ/SQ so that the > number of pages used doesn't fit into int. Even worse, then it's > truncated further to ushort. Limit them to the type size for now, but > it needs a better follow up. Nevermind, syz says it doesn't fix it.
diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c index bfa93888f862..82d217cfdebc 100644 --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -3482,7 +3482,7 @@ static __cold int io_allocate_scq_urings(struct io_ring_ctx *ctx, size = rings_size(ctx->flags, p->sq_entries, p->cq_entries, &sq_array_offset); - if (size == SIZE_MAX) + if (size == SIZE_MAX || (PAGE_ALIGN(size) >> PAGE_SHIFT) > USHRT_MAX) return -EOVERFLOW; if (!(ctx->flags & IORING_SETUP_NO_MMAP)) @@ -3505,7 +3505,7 @@ static __cold int io_allocate_scq_urings(struct io_ring_ctx *ctx, size = array_size(2 * sizeof(struct io_uring_sqe), p->sq_entries); else size = array_size(sizeof(struct io_uring_sqe), p->sq_entries); - if (size == SIZE_MAX) { + if (size == SIZE_MAX || (PAGE_ALIGN(size) >> PAGE_SHIFT) > USHRT_MAX) { io_rings_free(ctx); return -EOVERFLOW; }
WARNING: CPU: 0 PID: 5834 at io_uring/memmap.c:144 io_pin_pages+0x149/0x180 io_uring/memmap.c:144 CPU: 0 UID: 0 PID: 5834 Comm: syz-executor825 Not tainted 6.12.0-next-20241118-syzkaller #0 Call Trace: <TASK> __io_uaddr_map+0xfb/0x2d0 io_uring/memmap.c:183 io_rings_map io_uring/io_uring.c:2611 [inline] io_allocate_scq_urings+0x1c0/0x650 io_uring/io_uring.c:3470 io_uring_create+0x5b5/0xc00 io_uring/io_uring.c:3692 io_uring_setup io_uring/io_uring.c:3781 [inline] ... </TASK> Apparently there is a way to request a large enough CQ/SQ so that the number of pages used doesn't fit into int. Even worse, then it's truncated further to ushort. Limit them to the type size for now, but it needs a better follow up. Cc: stable@vger.kernel.org Reported-by: syzbot+2159cbb522b02847c053@syzkaller.appspotmail.com Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> --- io_uring/io_uring.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)