linux-fsdevel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Al Viro <viro@ZenIV.linux.org.uk>
To: linux-fsdevel@vger.kernel.org
Cc: Christoph Hellwig <hch@lst.de>
Subject: [PATCH 3/4] aio: shift copyin of iocb into io_submit_one()
Date: Sun, 27 May 2018 23:28:52 +0100	[thread overview]
Message-ID: <20180527222853.30715-3-viro@ZenIV.linux.org.uk> (raw)
In-Reply-To: <20180527222853.30715-1-viro@ZenIV.linux.org.uk>

From: Al Viro <viro@zeniv.linux.org.uk>

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---
 fs/aio.c | 46 ++++++++++++++++++++++------------------------
 1 file changed, 22 insertions(+), 24 deletions(-)

diff --git a/fs/aio.c b/fs/aio.c
index cb99a92a5324..29fa2f3c3cba 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -1716,22 +1716,26 @@ static ssize_t aio_poll(struct aio_kiocb *aiocb, struct iocb *iocb)
 }
 
 static int io_submit_one(struct kioctx *ctx, struct iocb __user *user_iocb,
-			 struct iocb *iocb, bool compat)
+			 bool compat)
 {
 	struct aio_kiocb *req;
+	struct iocb iocb;
 	ssize_t ret;
 
+	if (unlikely(copy_from_user(&iocb, user_iocb, sizeof(iocb))))
+		return -EFAULT;
+
 	/* enforce forwards compatibility on users */
-	if (unlikely(iocb->aio_reserved2)) {
+	if (unlikely(iocb.aio_reserved2)) {
 		pr_debug("EINVAL: reserve field set\n");
 		return -EINVAL;
 	}
 
 	/* prevent overflows */
 	if (unlikely(
-	    (iocb->aio_buf != (unsigned long)iocb->aio_buf) ||
-	    (iocb->aio_nbytes != (size_t)iocb->aio_nbytes) ||
-	    ((ssize_t)iocb->aio_nbytes < 0)
+	    (iocb.aio_buf != (unsigned long)iocb.aio_buf) ||
+	    (iocb.aio_nbytes != (size_t)iocb.aio_nbytes) ||
+	    ((ssize_t)iocb.aio_nbytes < 0)
 	   )) {
 		pr_debug("EINVAL: overflow check\n");
 		return -EINVAL;
@@ -1741,14 +1745,14 @@ static int io_submit_one(struct kioctx *ctx, struct iocb __user *user_iocb,
 	if (unlikely(!req))
 		return -EAGAIN;
 
-	if (iocb->aio_flags & IOCB_FLAG_RESFD) {
+	if (iocb.aio_flags & IOCB_FLAG_RESFD) {
 		/*
 		 * If the IOCB_FLAG_RESFD flag of aio_flags is set, get an
 		 * instance of the file* now. The file descriptor must be
 		 * an eventfd() fd, and will be signaled for each completed
 		 * event using the eventfd_signal() function.
 		 */
-		req->ki_eventfd = eventfd_ctx_fdget((int) iocb->aio_resfd);
+		req->ki_eventfd = eventfd_ctx_fdget((int) iocb.aio_resfd);
 		if (IS_ERR(req->ki_eventfd)) {
 			ret = PTR_ERR(req->ki_eventfd);
 			req->ki_eventfd = NULL;
@@ -1763,31 +1767,31 @@ static int io_submit_one(struct kioctx *ctx, struct iocb __user *user_iocb,
 	}
 
 	req->ki_user_iocb = user_iocb;
-	req->ki_user_data = iocb->aio_data;
+	req->ki_user_data = iocb.aio_data;
 
-	switch (iocb->aio_lio_opcode) {
+	switch (iocb.aio_lio_opcode) {
 	case IOCB_CMD_PREAD:
-		ret = aio_read(&req->rw, iocb, false, compat);
+		ret = aio_read(&req->rw, &iocb, false, compat);
 		break;
 	case IOCB_CMD_PWRITE:
-		ret = aio_write(&req->rw, iocb, false, compat);
+		ret = aio_write(&req->rw, &iocb, false, compat);
 		break;
 	case IOCB_CMD_PREADV:
-		ret = aio_read(&req->rw, iocb, true, compat);
+		ret = aio_read(&req->rw, &iocb, true, compat);
 		break;
 	case IOCB_CMD_PWRITEV:
-		ret = aio_write(&req->rw, iocb, true, compat);
+		ret = aio_write(&req->rw, &iocb, true, compat);
 		break;
 	case IOCB_CMD_FSYNC:
-		ret = aio_fsync(&req->fsync, iocb, false);
+		ret = aio_fsync(&req->fsync, &iocb, false);
 		break;
 	case IOCB_CMD_FDSYNC:
-		ret = aio_fsync(&req->fsync, iocb, true);
+		ret = aio_fsync(&req->fsync, &iocb, true);
 	case IOCB_CMD_POLL:
-		ret = aio_poll(req, iocb);
+		ret = aio_poll(req, &iocb);
 		break;
 	default:
-		pr_debug("invalid aio operation %d\n", iocb->aio_lio_opcode);
+		pr_debug("invalid aio operation %d\n", iocb.aio_lio_opcode);
 		ret = -EINVAL;
 		break;
 	}
@@ -1840,19 +1844,13 @@ static long do_io_submit(aio_context_t ctx_id, long nr,
 	 */
 	for (i=0; i<nr; i++) {
 		struct iocb __user *user_iocb;
-		struct iocb tmp;
 
 		if (unlikely(__get_user(user_iocb, iocbpp + i))) {
 			ret = -EFAULT;
 			break;
 		}
 
-		if (unlikely(copy_from_user(&tmp, user_iocb, sizeof(tmp)))) {
-			ret = -EFAULT;
-			break;
-		}
-
-		ret = io_submit_one(ctx, user_iocb, &tmp, compat);
+		ret = io_submit_one(ctx, user_iocb, compat);
 		if (ret)
 			break;
 	}
-- 
2.11.0

  parent reply	other threads:[~2018-05-27 22:28 UTC|newest]

Thread overview: 72+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-05-23 19:19 aio poll and a new in-kernel poll API V13 Christoph Hellwig
2018-05-23 19:19 ` [PATCH 01/33] fix io_destroy()/aio_complete() race Christoph Hellwig
2018-05-23 19:19 ` [PATCH 02/33] uapi: turn __poll_t sparse checkin on by default Christoph Hellwig
2018-05-23 19:19 ` [PATCH 03/33] fs: unexport poll_schedule_timeout Christoph Hellwig
2018-05-23 19:19 ` [PATCH 04/33] fs: cleanup do_pollfd Christoph Hellwig
2018-05-23 19:19 ` [PATCH 05/33] fs: update documentation to mention __poll_t and match the code Christoph Hellwig
2018-05-23 19:19 ` [PATCH 06/33] fs: add new vfs_poll and file_can_poll helpers Christoph Hellwig
2018-05-23 19:19 ` [PATCH 07/33] fs: introduce new ->get_poll_head and ->poll_mask methods Christoph Hellwig
2018-05-23 19:19 ` [PATCH 08/33] aio: simplify KIOCB_KEY handling Christoph Hellwig
2018-05-23 19:19 ` [PATCH 09/33] aio: simplify cancellation Christoph Hellwig
2018-05-23 19:19 ` [PATCH 10/33] aio: implement IOCB_CMD_POLL Christoph Hellwig
2018-05-23 19:20 ` [PATCH 11/33] aio: try to complete poll iocbs without context switch Christoph Hellwig
2018-05-23 19:20 ` [PATCH 12/33] net: refactor socket_poll Christoph Hellwig
2018-05-23 19:20 ` [PATCH 13/33] net: add support for ->poll_mask in proto_ops Christoph Hellwig
2018-05-23 19:20 ` [PATCH 14/33] net: remove sock_no_poll Christoph Hellwig
2018-05-23 19:20 ` [PATCH 15/33] net/tcp: convert to ->poll_mask Christoph Hellwig
2018-05-23 19:20 ` [PATCH 16/33] net/unix: " Christoph Hellwig
2018-05-23 19:20 ` [PATCH 17/33] net: convert datagram_poll users tp ->poll_mask Christoph Hellwig
2018-05-23 19:20 ` [PATCH 18/33] net/dccp: convert to ->poll_mask Christoph Hellwig
2018-05-23 19:20 ` [PATCH 19/33] net/atm: " Christoph Hellwig
2018-05-23 19:20 ` [PATCH 20/33] net/vmw_vsock: " Christoph Hellwig
2018-05-23 19:20 ` [PATCH 21/33] net/tipc: " Christoph Hellwig
2018-05-23 19:20 ` [PATCH 22/33] net/sctp: " Christoph Hellwig
2018-05-23 19:20 ` [PATCH 23/33] net/bluetooth: " Christoph Hellwig
2018-05-23 19:20 ` [PATCH 24/33] net/caif: " Christoph Hellwig
2018-05-23 19:20 ` [PATCH 25/33] net/nfc: " Christoph Hellwig
2018-05-23 19:20 ` [PATCH 26/33] net/phonet: " Christoph Hellwig
2018-05-23 19:20 ` [PATCH 27/33] net/iucv: " Christoph Hellwig
2018-05-23 19:20 ` [PATCH 28/33] net/rxrpc: " Christoph Hellwig
2018-05-23 19:20 ` [PATCH 29/33] crypto: af_alg: " Christoph Hellwig
2018-05-23 19:20 ` [PATCH 30/33] pipe: " Christoph Hellwig
2018-05-23 19:20 ` [PATCH 31/33] eventfd: switch " Christoph Hellwig
2018-05-23 19:20 ` [PATCH 32/33] timerfd: convert " Christoph Hellwig
2018-05-23 19:20 ` [PATCH 33/33] random: " Christoph Hellwig
2018-05-26  0:11 ` aio poll and a new in-kernel poll API V13 Al Viro
2018-05-26  7:09   ` Al Viro
2018-05-26  7:23     ` Christoph Hellwig
2018-05-27 22:27       ` Al Viro
2018-05-27 22:28         ` [PATCH 1/4] aio: all callers of aio_{read,write,fsync,poll} treat 0 and -EIOCBQUEUED the same way Al Viro
2018-05-27 22:28           ` [PATCH 2/4] aio_read_events_ring(): make a bit more readable Al Viro
2018-05-27 22:28           ` Al Viro [this message]
2018-05-28  5:16             ` [PATCH 3/4] aio: shift copyin of iocb into io_submit_one() Christoph Hellwig
2018-05-27 22:28           ` [PATCH 4/4] aio: fold do_io_submit() into callers Al Viro
2018-05-27 23:14             ` Al Viro
2018-05-28  5:24               ` Christoph Hellwig
2018-05-28  5:15           ` [PATCH 1/4] aio: all callers of aio_{read,write,fsync,poll} treat 0 and -EIOCBQUEUED the same way Christoph Hellwig
2018-05-28 14:04             ` Al Viro
2018-05-28 17:54               ` Al Viro
2018-05-28 17:57                 ` [PATCH v2 1/6] aio: take list removal to (some) callers of aio_complete() Al Viro
2018-05-28 17:57                   ` [PATCH v2 2/6] aio: all callers of aio_{read,write,fsync,poll} treat 0 and -EIOCBQUEUED the same way Al Viro
2018-05-29  6:08                     ` Christoph Hellwig
2018-05-28 17:57                   ` [PATCH v2 3/6] aio_read_events_ring(): make a bit more readable Al Viro
2018-05-28 17:57                   ` [PATCH v2 4/6] aio: shift copyin of iocb into io_submit_one() Al Viro
2018-05-28 17:57                   ` [PATCH v2 5/6] aio: fold do_io_submit() into callers Al Viro
2018-05-29  6:10                     ` Christoph Hellwig
2018-05-28 17:57                   ` [PATCH v2 6/6] aio: sanitize the limit checking in io_submit(2) Al Viro
2018-05-29  6:10                     ` Christoph Hellwig
2018-05-29  6:08                   ` [PATCH v2 1/6] aio: take list removal to (some) callers of aio_complete() Christoph Hellwig
2018-05-28 22:20                 ` [PATCH 1/4] vmsplice: lift import_iovec() into do_vmsplice() Al Viro
2018-05-28 22:20                   ` [PATCH 2/4] vmsplice(): lift importing iovec into vmsplice(2) and compat counterpart Al Viro
2018-05-28 22:20                   ` [PATCH 3/4] signalfd: lift sigmask copyin and size checks to callers of do_signalfd4() Al Viro
2018-05-28 22:20                   ` [PATCH 4/4] orangefs: simplify compat ioctl handling Al Viro
2018-05-31 11:11                     ` kbuild test robot
2018-05-31 20:54                     ` Mike Marshall
2018-05-31 21:03                       ` Al Viro
2018-06-01 21:13                         ` Mike Marshall
2018-06-06 22:57                   ` [1/4] vmsplice: lift import_iovec() into do_vmsplice() Andrei Vagin
2018-06-07 17:56                     ` Andrei Vagin
2018-06-11 20:14                       ` Cyrill Gorcunov
2018-06-11 20:16                         ` Al Viro
2018-06-11 20:18                           ` Cyrill Gorcunov
2018-06-14 22:22                           ` Andrey Vagin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20180527222853.30715-3-viro@ZenIV.linux.org.uk \
    --to=viro@zeniv.linux.org.uk \
    --cc=hch@lst.de \
    --cc=linux-fsdevel@vger.kernel.org \
    --subject='Re: [PATCH 3/4] aio: shift copyin of iocb into io_submit_one()' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).