linux-kernel - Re: [RFC PATCH 2/2] btrfs: ioctl: use registered buffer for IORING_URING_CMD

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <58181ba7-dcb5-4faa-a03a-8ff88cbffc24@gmail.com>
Date: Tue, 11 Mar 2025 12:55:48 +0000
From: Pavel Begunkov <asml.silence@...il.com>
To: Sidong Yang <sidong.yang@...iosa.ai>, Jens Axboe <axboe@...nel.dk>,
 Josef Bacik <josef@...icpanda.com>, David Sterba <dsterba@...e.com>
Cc: io-uring@...r.kernel.org, linux-kernel@...r.kernel.org,
 linux-btrfs@...r.kernel.org
Subject: Re: [RFC PATCH 2/2] btrfs: ioctl: use registered buffer for
 IORING_URING_CMD_FIXED

On 3/11/25 11:40, Sidong Yang wrote:
> This patch supports IORING_URING_CMD_FIXED flags in io-uring cmd. It
> means that user provided buf_index in sqe that is registered before
> submitting requests. In this patch, btrfs_uring_encoded_read() makes
> iov_iter bvec type by checking the io-uring cmd flag. And there is
> additional iou_vec field in btrfs_uring_priv for remaining bvecs
> lifecycle.
> 
> Signed-off-by: Sidong Yang <sidong.yang@...iosa.ai>
> ---
>   fs/btrfs/ioctl.c | 26 +++++++++++++++++++++-----
>   1 file changed, 21 insertions(+), 5 deletions(-)
> 
> diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
> index 6c18bad53cd3..586671eea622 100644
> --- a/fs/btrfs/ioctl.c
> +++ b/fs/btrfs/ioctl.c
> @@ -4643,6 +4643,7 @@ struct btrfs_uring_priv {
>   	struct page **pages;
>   	unsigned long nr_pages;
>   	struct kiocb iocb;
> +	struct iou_vec iou_vec;

This structure should not be leaked out of core io_uring ...

>   	struct iovec *iov;
>   	struct iov_iter iter;
>   	struct extent_state *cached_state;
> @@ -4711,6 +4712,8 @@ static void btrfs_uring_read_finished(struct io_uring_cmd *cmd, unsigned int iss
>   
>   	kfree(priv->pages);
>   	kfree(priv->iov);
> +	if (priv->iou_vec.iovec)
> +		kfree(priv->iou_vec.iovec);

... exactly because if this. This line relies on details it
shouldn't.

-- 
Pavel Begunkov