From: Greg Kroah-Hartman Date: Mon, 17 Aug 2020 13:47:27 +0000 (+0200) Subject: 5.4-stable patches X-Git-Tag: v4.19.140~7 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=e3edf640de3e83f0fb296b5086854c5a14d696d3;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: io_uring-fix-null-pointer-dereference-in-loop_rw_iter.patch --- diff --git a/queue-5.4/io_uring-fix-null-pointer-dereference-in-loop_rw_iter.patch b/queue-5.4/io_uring-fix-null-pointer-dereference-in-loop_rw_iter.patch new file mode 100644 index 00000000000..7f013679001 --- /dev/null +++ b/queue-5.4/io_uring-fix-null-pointer-dereference-in-loop_rw_iter.patch @@ -0,0 +1,106 @@ +From 2dd2111d0d383df104b144e0d1f6b5a00cb7cd88 Mon Sep 17 00:00:00 2001 +From: Guoyu Huang +Date: Wed, 5 Aug 2020 03:53:50 -0700 +Subject: io_uring: Fix NULL pointer dereference in loop_rw_iter() + +From: Guoyu Huang + +commit 2dd2111d0d383df104b144e0d1f6b5a00cb7cd88 upstream. + +loop_rw_iter() does not check whether the file has a read or +write function. This can lead to NULL pointer dereference +when the user passes in a file descriptor that does not have +read or write function. + +The crash log looks like this: + +[ 99.834071] BUG: kernel NULL pointer dereference, address: 0000000000000000 +[ 99.835364] #PF: supervisor instruction fetch in kernel mode +[ 99.836522] #PF: error_code(0x0010) - not-present page +[ 99.837771] PGD 8000000079d62067 P4D 8000000079d62067 PUD 79d8c067 PMD 0 +[ 99.839649] Oops: 0010 [#2] SMP PTI +[ 99.840591] CPU: 1 PID: 333 Comm: io_wqe_worker-0 Tainted: G D 5.8.0 #2 +[ 99.842622] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1 04/01/2014 +[ 99.845140] RIP: 0010:0x0 +[ 99.845840] Code: Bad RIP value. +[ 99.846672] RSP: 0018:ffffa1c7c01ebc08 EFLAGS: 00010202 +[ 99.848018] RAX: 0000000000000000 RBX: ffff92363bd67300 RCX: ffff92363d461208 +[ 99.849854] RDX: 0000000000000010 RSI: 00007ffdbf696bb0 RDI: ffff92363bd67300 +[ 99.851743] RBP: ffffa1c7c01ebc40 R08: 0000000000000000 R09: 0000000000000000 +[ 99.853394] R10: ffffffff9ec692a0 R11: 0000000000000000 R12: 0000000000000010 +[ 99.855148] R13: 0000000000000000 R14: ffff92363d461208 R15: ffffa1c7c01ebc68 +[ 99.856914] FS: 0000000000000000(0000) GS:ffff92363dd00000(0000) knlGS:0000000000000000 +[ 99.858651] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 99.860032] CR2: ffffffffffffffd6 CR3: 000000007ac66000 CR4: 00000000000006e0 +[ 99.861979] Call Trace: +[ 99.862617] loop_rw_iter.part.0+0xad/0x110 +[ 99.863838] io_write+0x2ae/0x380 +[ 99.864644] ? kvm_sched_clock_read+0x11/0x20 +[ 99.865595] ? sched_clock+0x9/0x10 +[ 99.866453] ? sched_clock_cpu+0x11/0xb0 +[ 99.867326] ? newidle_balance+0x1d4/0x3c0 +[ 99.868283] io_issue_sqe+0xd8f/0x1340 +[ 99.869216] ? __switch_to+0x7f/0x450 +[ 99.870280] ? __switch_to_asm+0x42/0x70 +[ 99.871254] ? __switch_to_asm+0x36/0x70 +[ 99.872133] ? lock_timer_base+0x72/0xa0 +[ 99.873155] ? switch_mm_irqs_off+0x1bf/0x420 +[ 99.874152] io_wq_submit_work+0x64/0x180 +[ 99.875192] ? kthread_use_mm+0x71/0x100 +[ 99.876132] io_worker_handle_work+0x267/0x440 +[ 99.877233] io_wqe_worker+0x297/0x350 +[ 99.878145] kthread+0x112/0x150 +[ 99.878849] ? __io_worker_unuse+0x100/0x100 +[ 99.879935] ? kthread_park+0x90/0x90 +[ 99.880874] ret_from_fork+0x22/0x30 +[ 99.881679] Modules linked in: +[ 99.882493] CR2: 0000000000000000 +[ 99.883324] ---[ end trace 4453745f4673190b ]--- +[ 99.884289] RIP: 0010:0x0 +[ 99.884837] Code: Bad RIP value. +[ 99.885492] RSP: 0018:ffffa1c7c01ebc08 EFLAGS: 00010202 +[ 99.886851] RAX: 0000000000000000 RBX: ffff92363acd7f00 RCX: ffff92363d461608 +[ 99.888561] RDX: 0000000000000010 RSI: 00007ffe040d9e10 RDI: ffff92363acd7f00 +[ 99.890203] RBP: ffffa1c7c01ebc40 R08: 0000000000000000 R09: 0000000000000000 +[ 99.891907] R10: ffffffff9ec692a0 R11: 0000000000000000 R12: 0000000000000010 +[ 99.894106] R13: 0000000000000000 R14: ffff92363d461608 R15: ffffa1c7c01ebc68 +[ 99.896079] FS: 0000000000000000(0000) GS:ffff92363dd00000(0000) knlGS:0000000000000000 +[ 99.898017] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 99.899197] CR2: ffffffffffffffd6 CR3: 000000007ac66000 CR4: 00000000000006e0 + +Fixes: 32960613b7c3 ("io_uring: correctly handle non ->{read,write}_iter() file_operations") +Cc: stable@vger.kernel.org +Signed-off-by: Guoyu Huang +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + fs/io_uring.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/fs/io_uring.c ++++ b/fs/io_uring.c +@@ -1433,8 +1433,10 @@ static int io_read(struct io_kiocb *req, + + if (file->f_op->read_iter) + ret2 = call_read_iter(file, kiocb, &iter); +- else ++ else if (req->file->f_op->read) + ret2 = loop_rw_iter(READ, file, kiocb, &iter); ++ else ++ ret2 = -EINVAL; + + /* + * In case of a short read, punt to async. This can happen +@@ -1524,8 +1526,10 @@ static int io_write(struct io_kiocb *req + + if (file->f_op->write_iter) + ret2 = call_write_iter(file, kiocb, &iter); +- else ++ else if (req->file->f_op->write) + ret2 = loop_rw_iter(WRITE, file, kiocb, &iter); ++ else ++ ret2 = -EINVAL; + + if (!force_nonblock) + current->signal->rlim[RLIMIT_FSIZE].rlim_cur = RLIM_INFINITY; diff --git a/queue-5.4/series b/queue-5.4/series index 072793326bd..0904d0a3826 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -267,3 +267,4 @@ xen-balloon-make-the-balloon-wait-interruptible.patch xen-gntdev-fix-dmabuf-import-with-non-zero-sgt-offset.patch s390-dasd-fix-inability-to-use-dasd-with-diag-driver.patch s390-gmap-improve-thp-splitting.patch +io_uring-fix-null-pointer-dereference-in-loop_rw_iter.patch