Unverified Commit fecdf43c authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!6076 Fix CVE-2024-26764 

Merge Pull Request from: @ci-robot 
 
PR sync from: ZhaoLong Wang <wangzhaolong1@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/4IYSL5LCLAZS2IDSW37Y23N5S5LCFABF/ 
Bart Van Assche (2):
  fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio
  fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion


-- 
2.39.2
 
https://gitee.com/src-openeuler/kernel/issues/I9E2O3 
 
Link:https://gitee.com/openeuler/kernel/pulls/6076

 

Reviewed-by: default avatarzhangyi (F) <yi.zhang@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents 0d79451b 5fe9f982

fs/aio.c

+14 −3
Original line number Diff line number Diff line
@@ -565,13 +565,24 @@ static int aio_setup_ring(struct kioctx *ctx, unsigned int nr_events) 


void kiocb_set_cancel_fn(struct kiocb *iocb, kiocb_cancel_fn *cancel)

{

	struct aio_kiocb *req = container_of(iocb, struct aio_kiocb, rw);

	struct kioctx *ctx = req->ki_ctx;

	struct aio_kiocb *req;

	struct kioctx *ctx;

	unsigned long flags;



	/*

	 * kiocb didn't come from aio or is neither a read nor a write, hence

	 * ignore it.

	 */

	if (!(iocb->ki_flags & IOCB_AIO_RW))

		return;



	req = container_of(iocb, struct aio_kiocb, rw);



	if (WARN_ON_ONCE(!list_empty(&req->ki_list)))

		return;



	ctx = req->ki_ctx;



	spin_lock_irqsave(&ctx->ctx_lock, flags);

	list_add_tail(&req->ki_list, &ctx->active_reqs);

	req->ki_cancel = cancel;
@@ -1454,7 +1465,7 @@ static int aio_prep_rw(struct kiocb *req, const struct iocb *iocb) 
	req->ki_complete = aio_complete_rw;

	req->private = NULL;

	req->ki_pos = iocb->aio_offset;

	req->ki_flags = iocb_flags(req->ki_filp);

	req->ki_flags = iocb_flags(req->ki_filp) | IOCB_AIO_RW;

	if (iocb->aio_flags & IOCB_FLAG_RESFD)

		req->ki_flags |= IOCB_EVENTFD;

	req->ki_hint = ki_hint_validate(file_write_hint(req->ki_filp));

include/linux/fs.h

+2 −0
Original line number Diff line number Diff line
@@ -328,6 +328,8 @@ enum rw_hint { 
/* iocb->ki_waitq is valid */

#define IOCB_WAITQ		(1 << 19)

#define IOCB_NOIO		(1 << 20)

/* kiocb is a read or write operation submitted by fs/aio.c. */

#define IOCB_AIO_RW		(1 << 23)



struct kiocb {

	struct file		*ki_filp;