Kernel/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2025-01-16 02:14:58 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
linux-stable/io_uring
History
Pavel Begunkov 29eac3eca7 io_uring: check for overflows in io_pin_pages 
commit 0c0a4eae26ac78379d0c1db053de168a8febc6c9 upstream.

WARNING: CPU: 0 PID: 5834 at io_uring/memmap.c:144 io_pin_pages+0x149/0x180 io_uring/memmap.c:144
CPU: 0 UID: 0 PID: 5834 Comm: syz-executor825 Not tainted 6.12.0-next-20241118-syzkaller #0
Call Trace:
 <TASK>
 __io_uaddr_map+0xfb/0x2d0 io_uring/memmap.c:183
 io_rings_map io_uring/io_uring.c:2611 [inline]
 io_allocate_scq_urings+0x1c0/0x650 io_uring/io_uring.c:3470
 io_uring_create+0x5b5/0xc00 io_uring/io_uring.c:3692
 io_uring_setup io_uring/io_uring.c:3781 [inline]
 ...
 </TASK>

io_pin_pages()'s uaddr parameter came directly from the user and can be
garbage. Don't just add size to it as it can overflow.

Cc: stable@vger.kernel.org
Reported-by: syzbot+2159cbb522b02847c053@syzkaller.appspotmail.com
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/1b7520ddb168e1d537d64be47414a0629d0d8f8f.1732581026.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-12-05 13:54:16 +01:00
..
advise.c
io_uring/advise: support 64-bit lengths
2024-06-16 14:54:55 -06:00
advise.h
io_uring: split out fadvise/madvise operations
2022-07-24 18:39:11 -06:00
alloc_cache.h
io_uring/alloc_cache: switch to array based caching
2024-04-15 08:10:25 -06:00
cancel.c
io_uring: fix warnings on shadow variables
2024-04-15 08:10:26 -06:00
cancel.h
io_uring: fix cancellation overwriting req->flags
2024-06-13 19:25:28 -06:00
epoll.c
io_uring: undeprecate epoll_ctl support
2023-05-26 20:22:41 -06:00
epoll.h
io_uring: move epoll handler to its own file
2022-07-24 18:39:11 -06:00
eventfd.c
io_uring/eventfd: move eventfd handling to separate file
2024-06-16 14:54:55 -06:00
eventfd.h
io_uring/eventfd: move eventfd handling to separate file
2024-06-16 14:54:55 -06:00
fdinfo.c
io_uring: fix warnings on shadow variables
2024-04-15 08:10:26 -06:00
fdinfo.h
io_uring: move fdinfo helpers to its own file
2022-07-24 18:39:12 -06:00
filetable.c
io_uring/filetable: don't unnecessarily clear/reset bitmap
2024-05-08 08:27:45 -06:00
filetable.h
io_uring: expand main struct io_kiocb flags to 64-bits
2024-02-08 13:27:03 -07:00
fs.c
io_uring/fs: consider link->flags when getting path for LINKAT
2023-11-20 09:01:42 -07:00
fs.h
io_uring: split out filesystem related operations
2022-07-24 18:39:11 -06:00
futex.c
io_uring/alloc_cache: switch to array based caching
2024-04-15 08:10:25 -06:00
futex.h
io_uring/alloc_cache: switch to array based caching
2024-04-15 08:10:25 -06:00
io_uring.c
io_uring: check if we need to reschedule during overflow flush
2024-10-17 15:26:36 +02:00
io_uring.h
io_uring/sqpoll: ensure task state is TASK_RUNNING when running task_work
2024-10-22 15:51:24 +02:00
io-wq.c
io_uring/io-wq: inherit cpuset of cgroup in io worker
2024-10-04 16:37:33 +02:00
io-wq.h
io_uring/io-wq: make io_wq_work flags atomic
2024-06-16 14:54:55 -06:00
kbuf.c
io_uring/kbuf: return correct iovec count from classic buffer peek
2024-08-30 10:45:54 -06:00
kbuf.h
io_uring/kbuf: add helpers for getting/peeking multiple buffers
2024-04-22 11:26:01 -06:00
Makefile
io_uring/eventfd: move eventfd handling to separate file
2024-06-16 14:54:55 -06:00
memmap.c
io_uring: check for overflows in io_pin_pages
2024-12-05 13:54:16 +01:00
memmap.h
io_uring: move mapping/allocation helpers to a separate file
2024-04-15 08:10:26 -06:00
msg_ring.c
io_uring/msg_ring: fix uninitialized use of target_req->flags
2024-07-25 08:41:35 -06:00
msg_ring.h
io_uring/msg_ring: add an alloc cache for io_kiocb entries
2024-06-24 08:39:55 -06:00
napi.c
io_uring/napi: remove duplicate io_napi_entry timeout assignation
2024-08-12 12:11:42 -06:00
napi.h
io_uring/napi: check napi_enabled in io_napi_add() before proceeding
2024-08-12 12:09:03 -06:00
net.c
io_uring/net: harden multishot termination case for recv
2024-10-10 12:04:09 +02:00
net.h
io_uring: Introduce IORING_OP_LISTEN
2024-06-19 07:57:21 -06:00
nop.c
io_uring: support to inject result for NOP
2024-05-10 06:09:45 -06:00
nop.h
io_uring: move nop into its own file
2022-07-24 18:39:11 -06:00
notif.c
io_uring/notif: disable LAZY_WAKE for linked notifs
2024-04-30 13:06:27 -06:00
notif.h
io_uring/notif: implement notification stacking
2024-04-22 19:31:18 -06:00
opdef.c
io_uring: Fix probe of disabled operations
2024-06-19 08:58:00 -06:00
opdef.h
io_uring: Fix probe of disabled operations
2024-06-19 08:58:00 -06:00
openclose.c
io_uring: enable audit and restrict cred override for IORING_OP_FIXED_FD_INSTALL
2024-01-23 15:25:14 -07:00
openclose.h
io_uring/openclose: add support for IORING_OP_FIXED_FD_INSTALL
2023-12-12 07:42:57 -07:00
poll.c
io_uring: keep multishot request NAPI timeout current
2024-07-30 06:18:58 -06:00
poll.h
io_uring/poll: shrink alloc cache size to 32
2024-04-15 08:10:25 -06:00
refs.h
io_uring: kill dead code in io_req_complete_post
2024-04-15 08:10:26 -06:00
register.c
io_uring: Allocate only necessary memory in io_probe
2024-06-19 08:58:00 -06:00
register.h
io_uring/register: move io_uring_register(2) related code to register.c
2023-12-19 08:54:20 -07:00
rsrc.c
io_uring/rsrc: ensure compat iovecs are copied correctly
2024-08-30 07:52:43 -06:00
rsrc.h
io_uring: remove io_req_put_rsrc_locked()
2024-04-15 08:10:26 -06:00
rw.c
io_uring/rw: fix missing NOWAIT check for O_DIRECT start write
2024-11-08 16:31:00 +01:00
rw.h
io_uring/alloc_cache: switch to array based caching
2024-04-15 08:10:25 -06:00
slist.h
io_uring: silence variable ‘prev’ set but not used warning
2023-03-09 10:10:58 -07:00
splice.c
splice: return type ssize_t from all helpers
2023-12-12 16:19:59 +01:00
splice.h
io_uring: split out splice related operations
2022-07-24 18:39:11 -06:00
sqpoll.c
io_uring/sqpoll: do not put cpumask on stack
2024-10-04 16:38:29 +02:00
sqpoll.h
io_uring/sqpoll: statistics of the true utilization of sq threads
2024-03-01 06:28:19 -07:00
statx.c
vfs: retire user_path_at_empty and drop empty arg from getname_flags
2024-06-05 17:03:57 +02:00
statx.h
io_uring: move statx handling to its own file
2022-07-24 18:39:11 -06:00
sync.c
io_uring: for requests that require async, force it
2023-01-29 15:18:26 -07:00
sync.h
io_uring: split out fs related sync/fallocate functions
2022-07-24 18:39:11 -06:00
tctx.c
io_uring: Add io_uring_setup flag to pre-register ring fd and never install it
2023-05-16 08:06:00 -06:00
tctx.h
io_uring: simplify __io_uring_add_tctx_node
2022-10-07 12:25:30 -06:00
timeout.c
io_uring: fix io_match_task must_hold
2024-07-24 08:01:49 -06:00
timeout.h
io_uring: remove unused return from io_disarm_next
2022-09-21 13:15:01 -06:00
truncate.c
io_uring: add support for ftruncate
2024-02-09 09:04:39 -07:00
truncate.h
io_uring: add support for ftruncate
2024-02-09 09:04:39 -07:00
uring_cmd.c
io_uring: simplify io_uring_cmd return
2024-07-24 08:01:49 -06:00
uring_cmd.h
io_uring/alloc_cache: switch to array based caching
2024-04-15 08:10:25 -06:00
waitid.c
io_uring: remove struct io_tw_state::locked
2024-04-15 08:10:24 -06:00
waitid.h
io_uring: add IORING_OP_WAITID support
2023-09-21 12:04:45 -06:00
xattr.c
vfs: retire user_path_at_empty and drop empty arg from getname_flags
2024-06-05 17:03:57 +02:00
xattr.h
io_uring: move xattr related opcodes to its own file
2022-07-24 18:39:11 -06:00