linux-kernel - Re: [PATCH AUTOSEL 5.18 37/53] io_uring: fix merge error in checking send/recv addr2 flags

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 28 Jun 2022 07:12:01 -0600
From:   Jens Axboe <axboe@...nel.dk>
To:     Sasha Levin <sashal@...nel.org>
Cc:     linux-kernel <linux-kernel@...r.kernel.org>,
        stable <stable@...r.kernel.org>, Sasha Levin <sashal@...nel.org>,
        io-uring <io-uring@...r.kernel.org>
Subject: Re: [PATCH AUTOSEL 5.18 37/53] io_uring: fix merge error in checking
 send/recv addr2 flags

On Mon, Jun 27, 2022 at 8:20 PM Sasha Levin <sashal@...nel.org> wrote:
>
> From: Jens Axboe <axboe@...nel.dk>
>
> [ Upstream commit b60cac14bb3c88cff2a7088d9095b01a80938c41 ]
>
> With the dropping of the IOPOLL checking in the per-opcode handlers,
> we inadvertently left two checks in the recv/recvmsg and send/sendmsg
> prep handlers for the same thing, and one of them includes addr2 which
> holds the flags for these opcodes.
>
> Fix it up and kill the redundant checks.
>
> Signed-off-by: Jens Axboe <axboe@...nel.dk>
> Signed-off-by: Sasha Levin <sashal@...nel.org>
> ---
>  fs/io_uring.c | 4 ----
>  1 file changed, 4 deletions(-)
>
> diff --git a/fs/io_uring.c b/fs/io_uring.c
> index 725c59c734f1..9eb20f8865ac 100644
> --- a/fs/io_uring.c
> +++ b/fs/io_uring.c
> @@ -5252,8 +5252,6 @@ static int io_sendmsg_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
>
>         if (unlikely(req->ctx->flags & IORING_SETUP_IOPOLL))
>                 return -EINVAL;
> -       if (unlikely(sqe->addr2 || sqe->file_index))
> -               return -EINVAL;
>
>         sr->umsg = u64_to_user_ptr(READ_ONCE(sqe->addr));
>         sr->len = READ_ONCE(sqe->len);
> @@ -5465,8 +5463,6 @@ static int io_recvmsg_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
>
>         if (unlikely(req->ctx->flags & IORING_SETUP_IOPOLL))
>                 return -EINVAL;
> -       if (unlikely(sqe->addr2 || sqe->file_index))
> -               return -EINVAL;
>
>         sr->umsg = u64_to_user_ptr(READ_ONCE(sqe->addr));
>         sr->len = READ_ONCE(sqe->len);

This doesn't look right, and cannot be as the problem was added with a
5.19 merge issue. Please drop this patch from 5.18-stable, thanks.

-- 
Jens Axboe