lkml.org 
[lkml]   [2021]   [Dec]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
SubjectRe: [PATCH 0/2] Revert "block: add single bio async direct IO helper" to avoid UAF
From
On 12/7/21 15:51, George Kennedy wrote:
> git bisect shows that commit 54a88eb838d3
> ("block: add single bio async direct IO helper")
> causes the following UAF: KASAN: use-after-free Write in io_submit_one
>
> Tried to root-cause the issue, but need the patch submitter's help in
> coming up with a fix.

Hey George, thanks for the report. Do you have a reproducer?

One spot I don't like is how errors from bio_iov_iter_get_pages()
are handled, will test it.

diff --git a/block/fops.c b/block/fops.c
index ad732a36f9b3..211f44974d1e 100644
--- a/block/fops.c
+++ b/block/fops.c
@@ -342,7 +342,7 @@ static ssize_t __blkdev_direct_IO_async(struct kiocb *iocb,
if (unlikely(ret)) {
bio->bi_status = BLK_STS_IOERR;
bio_endio(bio);
- return ret;
+ return -EIOCBQUEUED;
}
}
dio->size = bio->bi_iter.bi_size;

--
Pavel Begunkov

\
 
 \ /
  Last update: 2021-12-07 18:36    [W:0.065 / U:0.192 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site