From patchwork Mon Aug 9 11:52:36 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pavel Begunkov X-Patchwork-Id: 12426293 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-15.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9924AC4320A for ; Mon, 9 Aug 2021 11:53:19 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 7DF136101E for ; Mon, 9 Aug 2021 11:53:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235160AbhHILxi (ORCPT ); Mon, 9 Aug 2021 07:53:38 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37642 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235088AbhHILxg (ORCPT ); Mon, 9 Aug 2021 07:53:36 -0400 Received: from mail-wr1-x436.google.com (mail-wr1-x436.google.com [IPv6:2a00:1450:4864:20::436]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 94A43C0613D3; Mon, 9 Aug 2021 04:53:15 -0700 (PDT) Received: by mail-wr1-x436.google.com with SMTP id z4so21044230wrv.11; Mon, 09 Aug 2021 04:53:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=x+4wra4HxuvSp6gGCVI1S4IbawlslKqdZS2ju2uJ+hk=; b=snnjXX5akYWUzTGTzXa+4a2AcV8LH8jltO2Dpxm9qFVN4CcuOUIvuVEtD3X+pG+TPQ EGnQgd/HNYmsJtLx3OiYimKEV251HnG4q0nxwPOMIY10+QvCKKBQ4nP+aS6pbjjIDHrr LLLwtISx+7vaPB9XFrEtv53jU8Uq0MwvOa1u55BRvzT02fKl+YE38jpUgOWOyXXdiaeY T68ziDEqnWhvuGqbdevJm1SLm8d9WfUNff3pkzmFeq8dfiNyN+GlYbDg7mZpXGKoWtSr EGoG2eh/Q7kiJ/qTTw35yRRuiHK00nNM1y2IZThvyeTkacpgVhp9s+7EHy6ATqDtJdjM 4JLw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=x+4wra4HxuvSp6gGCVI1S4IbawlslKqdZS2ju2uJ+hk=; b=P9PpsWlbNKQLyoTv15vyaDqxKZPVkIRwgqHL8/c2yzjvrgRz+aTFdutyNNM3I2soSC IP0mjcfi1U6iR1tyBYkdSLTMrwPWdX0O/O45LigtWKoWNd9YPOq+6KhddfnR3Gm46Igp kiJZ2S/JUDDftmDfjC8ClXC8O9w4K19LC7k+YvZXoA7iTXPY7jybkhtFhcOS6bFPPHiD 8uos1aY3QS6ABqBqb0xwkFniWjG2fhMtohjwEE9Rpk0UDMsLP/i+1dZghfVc25FOzdPi UMK0F7ElBpdkhVKmjZUCHzLo740RviT5YPk9VKOIteLJscQj2ADDhrcz04ILp6wtC+Aq iqtw== X-Gm-Message-State: AOAM530veKdy9CpUQ9oPqEOyNLOsZX/hQ+X3ZOuMsRUTuzPaTxb9ZVzP e/dPdYzvKwWJTsKbjDzrf3M= X-Google-Smtp-Source: ABdhPJxO4t8RPG/eLJHtqvniU7f3oK63kE6lt362rmPXQ/IiIvUL6ZbE1bZQlOK4UEASK2bXGnCWiA== X-Received: by 2002:a05:6000:10c6:: with SMTP id b6mr25015640wrx.110.1628509994318; Mon, 09 Aug 2021 04:53:14 -0700 (PDT) Received: from localhost.localdomain ([85.255.236.119]) by smtp.gmail.com with ESMTPSA id f17sm22876828wrt.18.2021.08.09.04.53.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 09 Aug 2021 04:53:14 -0700 (PDT) From: Pavel Begunkov To: Alexander Viro , linux-fsdevel@vger.kernel.org, Jens Axboe , io-uring@vger.kernel.org Cc: linux-kernel@vger.kernel.org, asml.silence@gmail.com Subject: [PATCH 1/2] iov_iter: mark truncated iters Date: Mon, 9 Aug 2021 12:52:36 +0100 Message-Id: X-Mailer: git-send-email 2.32.0 In-Reply-To: References: MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org Track if an iterator has ever been truncated. This will be used to mitigate revert-truncate problems. Signed-off-by: Pavel Begunkov --- include/linux/uio.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/include/linux/uio.h b/include/linux/uio.h index 82c3c3e819e0..61b8d312d13a 100644 --- a/include/linux/uio.h +++ b/include/linux/uio.h @@ -30,6 +30,7 @@ enum iter_type { struct iov_iter { u8 iter_type; bool data_source; + bool truncated; size_t iov_offset; size_t count; union { @@ -254,8 +255,10 @@ static inline void iov_iter_truncate(struct iov_iter *i, u64 count) * conversion in assignement is by definition greater than all * values of size_t, including old i->count. */ - if (i->count > count) + if (i->count > count) { i->count = count; + i->truncated = true; + } } /* From patchwork Mon Aug 9 11:52:37 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pavel Begunkov X-Patchwork-Id: 12426295 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-15.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6BB29C432BE for ; Mon, 9 Aug 2021 11:53:20 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 4E49D6101E for ; Mon, 9 Aug 2021 11:53:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235088AbhHILxj (ORCPT ); Mon, 9 Aug 2021 07:53:39 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37646 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235150AbhHILxh (ORCPT ); Mon, 9 Aug 2021 07:53:37 -0400 Received: from mail-wr1-x42d.google.com (mail-wr1-x42d.google.com [IPv6:2a00:1450:4864:20::42d]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8DF9AC0613D3; Mon, 9 Aug 2021 04:53:16 -0700 (PDT) Received: by mail-wr1-x42d.google.com with SMTP id z4so21044303wrv.11; Mon, 09 Aug 2021 04:53:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=cQ0GxBzmBn0cY4nHySpyNtgPjOaBNrfUlQpeSZNDkRc=; b=oJhSh/0kkq4ODlZ8g6e4gwwOCd0/b5GX3iAlo8/MygyVVnj8d4uuYo/k1ph36Ncs1U zP591o9YDk0R9aXmLARU5lr1qYpAS3HmB4Mo346d08Cduh8TJBPKvtEcVvWpY6G1X+Kh vmS+8+Q9BdZGFK3oP877jYxRFLOIJoWT2jSNIvIpEphrL8N3XzQwN4tK1b9EyNJbl+3G AMMVAH0TVmvaIQyiRKUSf+TxFVjfRzsZbw7J3/lIv0othlBEzJA3iZJuI7Nmw+Mm9xnG /TKaRZpRdQD7QKWKYE7cAqhvRsOC3w4ZI6w4gKG6XpIDl0EHHC8QmGpSOTgIboyknSZH NhsQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=cQ0GxBzmBn0cY4nHySpyNtgPjOaBNrfUlQpeSZNDkRc=; b=DMH3PIl1XJ5RuiEclGDWscT3Pw8wVw2qkpex8T8tYrokgmFOjHZJBFLm7UcMmmm8Hc Y5R+hPxL7//H2VMygdFQWWiErMYMhtdZvEbrewfjllBnqDMxRvPX7ai2akdSyb84yKWp j9DbEZCC+SOHfFDlOcIRszHhUlWBqqC3x+dgwPPRaPKq1xzv01+rHuuXuOn47Y5+jCPe gnZXsqh6VoDeaAm827X/X5tq9ixlXCIcvdMp4cav+LQQDYJDwbATUnQ00An+FrdhO+1/ nSMbqX4mkgxUKoWUOfEDNJKb0iZEGQuIaoPj/J4EGK/72nHdFoyrV5MZMU7+RCeG5MYd 9eDw== X-Gm-Message-State: AOAM530OAVZ+Q5lBXapTwc3R4j/iAZhPUcQUAjqFLwdIxfMHq/DbMPGw iTOMPTvmaar0/EeprDK3j0o= X-Google-Smtp-Source: ABdhPJy1phGKVLGPj+menLFGblTXvdBjRjBg64U7LWqKRet8qKm9kO9ZxIuA3zLJHglSJ0e+eDB47Q== X-Received: by 2002:a5d:488f:: with SMTP id g15mr25068018wrq.98.1628509995252; Mon, 09 Aug 2021 04:53:15 -0700 (PDT) Received: from localhost.localdomain ([85.255.236.119]) by smtp.gmail.com with ESMTPSA id f17sm22876828wrt.18.2021.08.09.04.53.14 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 09 Aug 2021 04:53:14 -0700 (PDT) From: Pavel Begunkov To: Alexander Viro , linux-fsdevel@vger.kernel.org, Jens Axboe , io-uring@vger.kernel.org Cc: linux-kernel@vger.kernel.org, asml.silence@gmail.com Subject: [PATCH 2/2] io_uring: don't retry with truncated iter Date: Mon, 9 Aug 2021 12:52:37 +0100 Message-Id: <8860f13c571b5b691253d84f781abfb0e97a0c39.1628509745.git.asml.silence@gmail.com> X-Mailer: git-send-email 2.32.0 In-Reply-To: References: MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org [ 74.211232] BUG: KASAN: stack-out-of-bounds in iov_iter_revert+0x809/0x900 [ 74.212778] Read of size 8 at addr ffff888025dc78b8 by task syz-executor.0/828 [ 74.214756] CPU: 0 PID: 828 Comm: syz-executor.0 Not tainted 5.14.0-rc3-next-20210730 #1 [ 74.216525] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 74.219033] Call Trace: [ 74.219683] dump_stack_lvl+0x8b/0xb3 [ 74.220706] print_address_description.constprop.0+0x1f/0x140 [ 74.224226] kasan_report.cold+0x7f/0x11b [ 74.226085] iov_iter_revert+0x809/0x900 [ 74.227960] io_write+0x57d/0xe40 [ 74.232647] io_issue_sqe+0x4da/0x6a80 [ 74.242578] __io_queue_sqe+0x1ac/0xe60 [ 74.245358] io_submit_sqes+0x3f6e/0x76a0 [ 74.248207] __do_sys_io_uring_enter+0x90c/0x1a20 [ 74.257167] do_syscall_64+0x3b/0x90 [ 74.257984] entry_SYSCALL_64_after_hwframe+0x44/0xae old_size = iov_iter_count(); ... iov_iter_revert(old_size - iov_iter_count()); If iov_iter_revert() is done base on the initial size as above, and the iter is truncated and not reexpanded in the middle, it miscalculates borders causing problems. This trace is due to no one reexpanding after generic_write_checks(). Avoid reverting truncated iterators, so io_uring would fail requests with EAGAIN instead of retrying them. Cc: stable@vger.kernel.org Reported-by: Sudip Mukherjee Reported-by: Palash Oswal Suggested-by: Jens Axboe Signed-off-by: Pavel Begunkov --- fs/io_uring.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/fs/io_uring.c b/fs/io_uring.c index bf548af0426c..ebf467e0cb0f 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -2425,6 +2425,8 @@ static bool io_resubmit_prep(struct io_kiocb *req) if (!rw) return !io_req_prep_async(req); + if (rw->iter.truncated) + return false; /* may have left rw->iter inconsistent on -EIOCBQUEUED */ iov_iter_revert(&rw->iter, req->result - iov_iter_count(&rw->iter)); return true; @@ -3316,6 +3318,8 @@ static int io_read(struct io_kiocb *req, unsigned int issue_flags) /* no retry on NONBLOCK nor RWF_NOWAIT */ if (req->flags & REQ_F_NOWAIT) goto done; + if (iter->truncated) + goto done; /* some cases will consume bytes even on error returns */ iov_iter_revert(iter, io_size - iov_iter_count(iter)); ret = 0; @@ -3455,6 +3459,8 @@ static int io_write(struct io_kiocb *req, unsigned int issue_flags) kiocb_done(kiocb, ret2, issue_flags); } else { copy_iov: + if (iter->truncated) + goto done; /* some cases will consume bytes even on error returns */ iov_iter_revert(iter, io_size - iov_iter_count(iter)); ret = io_setup_async_rw(req, iovec, inline_vecs, iter, false);