kevin/linux
1
Fork 0
Code

io_uring/kbuf: don't allow registered buffer rings on highmem pages

Browse Source 
syzbot reports that registering a mapped buffer ring on arm32 can
trigger an OOPS. Registered buffer rings have two modes, one of them
is the application passing in the memory that the buffer ring should
reside in. Once those pages are mapped, we use page_address() to get
a virtual address. This will obviously fail on highmem pages, which
aren't mapped.

Add a check if we have any highmem pages after mapping, and fail the
attempt to register a provided buffer ring if we do. This will return
the same error as kernels that don't support provided buffer rings to
begin with.

Link: https://lore.kernel.org/io-uring/000000000000af635c0606bcb889@google.com/
Fixes: c56e022c0a ("io_uring: add support for user mapped provided buffer ring")
Cc: stable@vger.kernel.org
Reported-by: syzbot+2113e61b8848fa7951d8@syzkaller.appspotmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
This commit is contained in:
Jens Axboe 2023-10-02 18:14:08 -06:00
parent a52d4f6575
commit f8024f1f36
1 changed files with 19 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
io_uring/kbuf.c
View File

@ -477,7 +477,7 @@ static int io_pin_pbuf_ring(struct io_uring_buf_reg *reg,
{ {
struct io_uring_buf_ring *br; struct io_uring_buf_ring *br;
struct page **pages; struct page **pages;
int nr_pages; int i, nr_pages;
pages = io_pin_pages(reg->ring_addr, pages = io_pin_pages(reg->ring_addr,
flex_array_size(br, bufs, reg->ring_entries), flex_array_size(br, bufs, reg->ring_entries),
@ -485,6 +485,17 @@ static int io_pin_pbuf_ring(struct io_uring_buf_reg *reg,
if (IS_ERR(pages)) if (IS_ERR(pages))
return PTR_ERR(pages); return PTR_ERR(pages);
/*
* Apparently some 32-bit boxes (ARM) will return highmem pages,
* which then need to be mapped. We could support that, but it'd
* complicate the code and slowdown the common cases quite a bit.
* So just error out, returning -EINVAL just like we did on kernels
* that didn't support mapped buffer rings.
*/
for (i = 0; i < nr_pages; i++)
if (PageHighMem(pages[i]))
goto error_unpin;
br = page_address(pages[0]); br = page_address(pages[0]);
#ifdef SHM_COLOUR #ifdef SHM_COLOUR
/* /*
@ -496,13 +507,8 @@ static int io_pin_pbuf_ring(struct io_uring_buf_reg *reg,
* should use IOU_PBUF_RING_MMAP instead, and liburing will handle * should use IOU_PBUF_RING_MMAP instead, and liburing will handle
* this transparently. * this transparently.
*/ */
if ((reg->ring_addr | (unsigned long) br) & (SHM_COLOUR - 1)) { if ((reg->ring_addr | (unsigned long) br) & (SHM_COLOUR - 1))
int i; goto error_unpin;
for (i = 0; i < nr_pages; i++)
unpin_user_page(pages[i]);
return -EINVAL;
}
#endif #endif
bl->buf_pages = pages; bl->buf_pages = pages;
bl->buf_nr_pages = nr_pages; bl->buf_nr_pages = nr_pages;
@ -510,6 +516,11 @@ static int io_pin_pbuf_ring(struct io_uring_buf_reg *reg,
bl->is_mapped = 1; bl->is_mapped = 1;
bl->is_mmap = 0; bl->is_mmap = 0;
return 0; return 0;
error_unpin:
for (i = 0; i < nr_pages; i++)
unpin_user_page(pages[i]);
kvfree(pages);
return -EINVAL;
} }
static int io_alloc_pbuf_ring(struct io_uring_buf_reg *reg, static int io_alloc_pbuf_ring(struct io_uring_buf_reg *reg,