From: Dan Carpenter <dan.carpenter@oracle.com> To: "David S. Miller" <davem@davemloft.net>, Alexander Viro <viro@zeniv.linux.org.uk>, Jens Axboe <axboe@kernel.dk> Cc: Amritha Nambiar <amritha.nambiar@intel.com>, Willem de Bruijn <willemb@google.com>, kernel-janitors@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-block@vger.kernel.org, linux-kernel@vger.kernel.org, Peter Zijlstra <peterz@infradead.org> Subject: [PATCH v2 2/2] io_uring: Potential Oops in io_sq_offload_start() Date: Mon, 8 Apr 2019 11:15:13 +0300 [thread overview] Message-ID: <20190408081513.GB15239@kadam> (raw) In-Reply-To: <20190404104527.GX4038@hirez.programming.kicks-ass.net> The "p->sq_thread_cpu" variable is an integer which comes from the user. We can't pass values greater than NR_CPUS to cpu_possible() or it could lead to an out of bound read and possibly an Oops. The recently added cpu_possible_safe() function can handle unfiltered input so lets use that instead. This patch also removes the call to array_index_nospec() since that is handled in cpu_possible_safe(). Fixes: 6c271ce2f1d5 ("io_uring: add submission polling") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> --- No change. fs/io_uring.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/fs/io_uring.c b/fs/io_uring.c index c0fecb9d889f..9789887b0d36 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -2240,16 +2240,13 @@ static int io_sq_offload_start(struct io_ring_ctx *ctx, ctx->sq_thread_idle = HZ; ret = -EINVAL; - if (!cpu_possible(p->sq_thread_cpu)) + if (!cpu_possible_safe(p->sq_thread_cpu)) goto err; if (ctx->flags & IORING_SETUP_SQPOLL) { if (p->flags & IORING_SETUP_SQ_AFF) { - int cpu; - - cpu = array_index_nospec(p->sq_thread_cpu, NR_CPUS); ctx->sqo_thread = kthread_create_on_cpu(io_sq_thread, - ctx, cpu, + ctx, p->sq_thread_cpu, "io_uring-sq"); } else { ctx->sqo_thread = kthread_create(io_sq_thread, ctx, -- 2.17.1
WARNING: multiple messages have this Message-ID (diff)
From: Dan Carpenter <dan.carpenter@oracle.com> To: "David S. Miller" <davem@davemloft.net>, Alexander Viro <viro@zeniv.linux.org.uk>, Jens Axboe <axboe@kernel.dk> Cc: Amritha Nambiar <amritha.nambiar@intel.com>, Willem de Bruijn <willemb@google.com>, kernel-janitors@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-block@vger.kernel.org, linux-kernel@vger.kernel.org, Peter Zijlstra <peterz@infradead.org> Subject: [PATCH v2 2/2] io_uring: Potential Oops in io_sq_offload_start() Date: Mon, 08 Apr 2019 08:15:13 +0000 [thread overview] Message-ID: <20190408081513.GB15239@kadam> (raw) In-Reply-To: <20190404104527.GX4038@hirez.programming.kicks-ass.net> The "p->sq_thread_cpu" variable is an integer which comes from the user. We can't pass values greater than NR_CPUS to cpu_possible() or it could lead to an out of bound read and possibly an Oops. The recently added cpu_possible_safe() function can handle unfiltered input so lets use that instead. This patch also removes the call to array_index_nospec() since that is handled in cpu_possible_safe(). Fixes: 6c271ce2f1d5 ("io_uring: add submission polling") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> --- No change. fs/io_uring.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/fs/io_uring.c b/fs/io_uring.c index c0fecb9d889f..9789887b0d36 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -2240,16 +2240,13 @@ static int io_sq_offload_start(struct io_ring_ctx *ctx, ctx->sq_thread_idle = HZ; ret = -EINVAL; - if (!cpu_possible(p->sq_thread_cpu)) + if (!cpu_possible_safe(p->sq_thread_cpu)) goto err; if (ctx->flags & IORING_SETUP_SQPOLL) { if (p->flags & IORING_SETUP_SQ_AFF) { - int cpu; - - cpu = array_index_nospec(p->sq_thread_cpu, NR_CPUS); ctx->sqo_thread = kthread_create_on_cpu(io_sq_thread, - ctx, cpu, + ctx, p->sq_thread_cpu, "io_uring-sq"); } else { ctx->sqo_thread = kthread_create(io_sq_thread, ctx, -- 2.17.1
next prev parent reply other threads:[~2019-04-08 8:15 UTC|newest] Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top 2019-04-04 10:02 [PATCH 1/2] cpumask: Introduce possible_cpu_safe() Dan Carpenter 2019-04-04 10:02 ` Dan Carpenter 2019-04-04 10:04 ` [PATCH 2/2] io_uring: Potential Oops in io_sq_offload_start() Dan Carpenter 2019-04-04 10:04 ` Dan Carpenter 2019-04-04 10:35 ` [PATCH 1/2] cpumask: Introduce possible_cpu_safe() Michal Hocko 2019-04-04 10:35 ` Michal Hocko 2019-04-04 11:28 ` Peter Zijlstra 2019-04-04 11:28 ` Peter Zijlstra 2019-04-04 10:45 ` Peter Zijlstra 2019-04-04 10:45 ` Peter Zijlstra 2019-04-08 8:09 ` [PATCH v2 " Dan Carpenter 2019-04-08 8:09 ` Dan Carpenter 2019-04-08 8:15 ` Dan Carpenter [this message] 2019-04-08 8:15 ` [PATCH v2 2/2] io_uring: Potential Oops in io_sq_offload_start() Dan Carpenter 2019-04-30 9:26 ` Dan Carpenter 2019-04-30 9:26 ` Dan Carpenter 2019-05-03 11:43 ` Dan Carpenter 2019-05-03 11:43 ` Dan Carpenter
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20190408081513.GB15239@kadam \ --to=dan.carpenter@oracle.com \ --cc=amritha.nambiar@intel.com \ --cc=axboe@kernel.dk \ --cc=davem@davemloft.net \ --cc=kernel-janitors@vger.kernel.org \ --cc=linux-block@vger.kernel.org \ --cc=linux-fsdevel@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=peterz@infradead.org \ --cc=viro@zeniv.linux.org.uk \ --cc=willemb@google.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.