[PATCH 0/1] io_uring: validate the full range of provided buffers for access

[PATCH 0/1] io_uring: validate the full range of provided buffers for access

[Bijan Mottahedeh]

I hard coded (user_max_address() - PAGESIZE) as the start address 
in liburing/test/read-write.c:test_buf_select() and provided two buffers
of PAGESIZE each.  Without the patch, io_uring_prep_provide_buffers()
succeeds but the subsequent __test_io() obviously fails with -EFAULT.
With the patch, io_uring_prep_provide_buffers() fails with -EFAULT.
I think this would be a good test case to add but I'm not sure what
would be a generic way to implement it.

Bijan Mottahedeh (1):
  io_uring: validate the full range of provided buffers for access

 fs/io_uring.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

-- 
1.8.3.1

[PATCH 1/1] io_uring: validate the full range of provided buffers for access

[Bijan Mottahedeh]

Account for the number of provided buffers when validating the address
range.

Signed-off-by: Bijan Mottahedeh <bijan.mottahedeh@oracle.com>
---
 fs/io_uring.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/io_uring.c b/fs/io_uring.c
index bb25e39..c64ea37 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -3116,7 +3116,7 @@ static int io_provide_buffers_prep(struct io_kiocb *req,
 	p->addr = READ_ONCE(sqe->addr);
 	p->len = READ_ONCE(sqe->len);
 
-	if (!access_ok(u64_to_user_ptr(p->addr), p->len))
+	if (!access_ok(u64_to_user_ptr(p->addr), (p->len * p->nbufs)))
 		return -EFAULT;
 
 	p->bgid = READ_ONCE(sqe->buf_group);
-- 
1.8.3.1

Re: [PATCH 0/1] io_uring: validate the full range of provided buffers for access

[Jens Axboe]

On 6/4/20 7:01 PM, Bijan Mottahedeh wrote:
> I hard coded (user_max_address() - PAGESIZE) as the start address 
> in liburing/test/read-write.c:test_buf_select() and provided two buffers
> of PAGESIZE each.  Without the patch, io_uring_prep_provide_buffers()
> succeeds but the subsequent __test_io() obviously fails with -EFAULT.
> With the patch, io_uring_prep_provide_buffers() fails with -EFAULT.
> I think this would be a good test case to add but I'm not sure what
> would be a generic way to implement it.

Thanks, looks good to me. Applied for 5.8.

-- 
Jens Axboe