Commit 22b08240 authored by Bart Van Assche's avatar Bart Van Assche Committed by ZhaoLong Wang
Browse files

fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio 

stable inclusion
from stable-v5.10.211
commit ea1cd64d59f22d6d13f367d62ec6e27b9344695f
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2O3
CVE: CVE-2024-26764

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=ea1cd64d59f22d6d13f367d62ec6e27b9344695f



--------------------------------

commit b820de741ae48ccf50dd95e297889c286ff4f760 upstream.

If kiocb_set_cancel_fn() is called for I/O submitted via io_uring, the
following kernel warning appears:

WARNING: CPU: 3 PID: 368 at fs/aio.c:598 kiocb_set_cancel_fn+0x9c/0xa8
Call trace:
 kiocb_set_cancel_fn+0x9c/0xa8
 ffs_epfile_read_iter+0x144/0x1d0
 io_read+0x19c/0x498
 io_issue_sqe+0x118/0x27c
 io_submit_sqes+0x25c/0x5fc
 __arm64_sys_io_uring_enter+0x104/0xab0
 invoke_syscall+0x58/0x11c
 el0_svc_common+0xb4/0xf4
 do_el0_svc+0x2c/0xb0
 el0_svc+0x2c/0xa4
 el0t_64_sync_handler+0x68/0xb4
 el0t_64_sync+0x1a4/0x1a8

Fix this by setting the IOCB_AIO_RW flag for read and write I/O that is
submitted by libaio.

Suggested-by: default avatarJens Axboe <axboe@kernel.dk>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Avi Kivity <avi@scylladb.com>
Cc: Sandeep Dhavale <dhavale@google.com>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Kent Overstreet <kent.overstreet@linux.dev>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarBart Van Assche <bvanassche@acm.org>
Link: https://lore.kernel.org/r/20240215204739.2677806-2-bvanassche@acm.org


Signed-off-by: default avatarChristian Brauner <brauner@kernel.org>
Signed-off-by: default avatarBart Van Assche <bvanassche@acm.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarZhaoLong Wang <wangzhaolong1@huawei.com>
parent 30b94f5b

fs/aio.c

+8 −1
Original line number Diff line number Diff line
@@ -569,6 +569,13 @@ void kiocb_set_cancel_fn(struct kiocb *iocb, kiocb_cancel_fn *cancel) 
	struct kioctx *ctx = req->ki_ctx;

	unsigned long flags;



	/*

	 * kiocb didn't come from aio or is neither a read nor a write, hence

	 * ignore it.

	 */

	if (!(iocb->ki_flags & IOCB_AIO_RW))

		return;



	if (WARN_ON_ONCE(!list_empty(&req->ki_list)))

		return;
@@ -1454,7 +1461,7 @@ static int aio_prep_rw(struct kiocb *req, const struct iocb *iocb) 
	req->ki_complete = aio_complete_rw;

	req->private = NULL;

	req->ki_pos = iocb->aio_offset;

	req->ki_flags = iocb_flags(req->ki_filp);

	req->ki_flags = iocb_flags(req->ki_filp) | IOCB_AIO_RW;

	if (iocb->aio_flags & IOCB_FLAG_RESFD)

		req->ki_flags |= IOCB_EVENTFD;

	req->ki_hint = ki_hint_validate(file_write_hint(req->ki_filp));

include/linux/fs.h

+2 −0
Original line number Diff line number Diff line
@@ -328,6 +328,8 @@ enum rw_hint { 
/* iocb->ki_waitq is valid */

#define IOCB_WAITQ		(1 << 19)

#define IOCB_NOIO		(1 << 20)

/* kiocb is a read or write operation submitted by fs/aio.c. */

#define IOCB_AIO_RW		(1 << 23)



struct kiocb {

	struct file		*ki_filp;