IO-Uring Archive on lore.kernel.org
 help / color / Atom feed
* [PATCH 0/2] address resourse leaks
@ 2020-02-08 10:28 Pavel Begunkov
  2020-02-08 10:28 ` [PATCH 1/2] io_uring: fix double prep iovec leak Pavel Begunkov
  2020-02-08 10:28 ` [PATCH 2/2] io_uring: fix openat/statx's filename leak Pavel Begunkov
  0 siblings, 2 replies; 3+ messages in thread
From: Pavel Begunkov @ 2020-02-08 10:28 UTC (permalink / raw)
  To: Jens Axboe, io-uring, linux-kernel

This fixes the last prep/submission-related leaking hole I found.
The first patch is only for read/write/send/recv, so may be 5.5-ported
if needed. The second one doing the same but for openat{,2} and statx.

Pavel Begunkov (2):
  io_uring: fix double prep iovec leak
  io_uring: fix openat/statx's filename leak

 fs/io_uring.c | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

-- 
2.24.0


^ permalink raw reply	[flat|nested] 3+ messages in thread

* [PATCH 1/2] io_uring: fix double prep iovec leak
  2020-02-08 10:28 [PATCH 0/2] address resourse leaks Pavel Begunkov
@ 2020-02-08 10:28 ` Pavel Begunkov
  2020-02-08 10:28 ` [PATCH 2/2] io_uring: fix openat/statx's filename leak Pavel Begunkov
  1 sibling, 0 replies; 3+ messages in thread
From: Pavel Begunkov @ 2020-02-08 10:28 UTC (permalink / raw)
  To: Jens Axboe, io-uring, linux-kernel

Requests may be prepared multiple times with ->io allocated (i.e. async
prepared). Preparation functions doesn't handle it and forget about
previously allocated resources. This may happen in case of:
- spurious defer_check
- non-head (i.e. async prepared) request executed in sync (via nxt).

Make the handlers to check, whether they already allocated resources,
what is true IFF REQ_F_NEED_CLEANUP is set.

Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
---
 fs/io_uring.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 1698b4950366..f5aa2fdccf7a 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -2187,7 +2187,8 @@ static int io_read_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe,
 	if (unlikely(!(req->file->f_mode & FMODE_READ)))
 		return -EBADF;
 
-	if (!req->io)
+	/* either don't need iovec imported or already have it */
+	if (!req->io || req->flags & REQ_F_NEED_CLEANUP)
 		return 0;
 
 	io = req->io;
@@ -2275,7 +2276,8 @@ static int io_write_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe,
 	if (unlikely(!(req->file->f_mode & FMODE_WRITE)))
 		return -EBADF;
 
-	if (!req->io)
+	/* either don't need iovec imported or already have it */
+	if (!req->io || req->flags & REQ_F_NEED_CLEANUP)
 		return 0;
 
 	io = req->io;
@@ -2981,6 +2983,9 @@ static int io_sendmsg_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
 
 	if (!io || req->opcode == IORING_OP_SEND)
 		return 0;
+	/* iovec is already imported */
+	if (req->flags & REQ_F_NEED_CLEANUP)
+		return 0;
 
 	io->msg.iov = io->msg.fast_iov;
 	ret = sendmsg_copy_msghdr(&io->msg.msg, sr->msg, sr->msg_flags,
@@ -3131,6 +3136,9 @@ static int io_recvmsg_prep(struct io_kiocb *req,
 
 	if (!io || req->opcode == IORING_OP_RECV)
 		return 0;
+	/* iovec is already imported */
+	if (req->flags & REQ_F_NEED_CLEANUP)
+		return 0;
 
 	io->msg.iov = io->msg.fast_iov;
 	ret = recvmsg_copy_msghdr(&io->msg.msg, sr->msg, sr->msg_flags,
-- 
2.24.0


^ permalink raw reply	[flat|nested] 3+ messages in thread

* [PATCH 2/2] io_uring: fix openat/statx's filename leak
  2020-02-08 10:28 [PATCH 0/2] address resourse leaks Pavel Begunkov
  2020-02-08 10:28 ` [PATCH 1/2] io_uring: fix double prep iovec leak Pavel Begunkov
@ 2020-02-08 10:28 ` Pavel Begunkov
  1 sibling, 0 replies; 3+ messages in thread
From: Pavel Begunkov @ 2020-02-08 10:28 UTC (permalink / raw)
  To: Jens Axboe, io-uring, linux-kernel

As in the previous patch, make openat*_prep() and statx_prep() to
handle double prepartion to avoid resource leakage.

Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
---
 fs/io_uring.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/io_uring.c b/fs/io_uring.c
index f5aa2fdccf7a..c3bac9d850a5 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -2536,6 +2536,8 @@ static int io_openat_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
 		return -EINVAL;
 	if (sqe->flags & IOSQE_FIXED_FILE)
 		return -EINVAL;
+	if (req->flags & REQ_F_NEED_CLEANUP)
+		return 0;
 
 	req->open.dfd = READ_ONCE(sqe->fd);
 	req->open.how.mode = READ_ONCE(sqe->len);
@@ -2564,6 +2566,8 @@ static int io_openat2_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
 		return -EINVAL;
 	if (sqe->flags & IOSQE_FIXED_FILE)
 		return -EINVAL;
+	if (req->flags & REQ_F_NEED_CLEANUP)
+		return 0;
 
 	req->open.dfd = READ_ONCE(sqe->fd);
 	fname = u64_to_user_ptr(READ_ONCE(sqe->addr));
@@ -2763,6 +2767,8 @@ static int io_statx_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
 		return -EINVAL;
 	if (sqe->flags & IOSQE_FIXED_FILE)
 		return -EINVAL;
+	if (req->flags & REQ_F_NEED_CLEANUP)
+		return 0;
 
 	req->open.dfd = READ_ONCE(sqe->fd);
 	req->open.mask = READ_ONCE(sqe->len);
-- 
2.24.0


^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, back to index

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-02-08 10:28 [PATCH 0/2] address resourse leaks Pavel Begunkov
2020-02-08 10:28 ` [PATCH 1/2] io_uring: fix double prep iovec leak Pavel Begunkov
2020-02-08 10:28 ` [PATCH 2/2] io_uring: fix openat/statx's filename leak Pavel Begunkov

IO-Uring Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/io-uring/0 io-uring/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 io-uring io-uring/ https://lore.kernel.org/io-uring \
		io-uring@vger.kernel.org
	public-inbox-index io-uring

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.io-uring


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git