linux-kernel - Re: [PATCH 0/2] Revert "block: add single bio async direct IO helper" to avoid UAF

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <95ea9142-9f36-981d-a04d-3efded544af7@gmail.com>
Date:   Tue, 7 Dec 2021 17:36:24 +0000
From:   Pavel Begunkov <asml.silence@...il.com>
To:     George Kennedy <george.kennedy@...cle.com>,
        gregkh@...uxfoundation.org, axboe@...nel.dk
Cc:     linux-block@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 0/2] Revert "block: add single bio async direct IO helper"
 to avoid UAF

On 12/7/21 15:51, George Kennedy wrote:
> git bisect shows that commit 54a88eb838d3
> ("block: add single bio async direct IO helper")
> causes the following UAF: KASAN: use-after-free Write in io_submit_one
> 
> Tried to root-cause the issue, but need the patch submitter's help in
> coming up with a fix.

Hey George, thanks for the report. Do you have a reproducer?

One spot I don't like is how errors from bio_iov_iter_get_pages()
are handled, will test it.

diff --git a/block/fops.c b/block/fops.c
index ad732a36f9b3..211f44974d1e 100644
--- a/block/fops.c
+++ b/block/fops.c
@@ -342,7 +342,7 @@ static ssize_t __blkdev_direct_IO_async(struct kiocb *iocb,
  		if (unlikely(ret)) {
  			bio->bi_status = BLK_STS_IOERR;
  			bio_endio(bio);
-			return ret;
+			return -EIOCBQUEUED;
  		}
  	}
  	dio->size = bio->bi_iter.bi_size;


-- 
Pavel Begunkov