[PATCH] iouring:added boundary value check for io_uring_group systl

[PATCH] iouring:added boundary value check for io_uring_group systl

[Subramanya Swamy]

/proc/sys/kernel/io_uring_group takes gid as input
added boundary value check to accept gid in range of
0<=gid<=4294967294 & Documentation is updated for same

Signed-off-by: Subramanya Swamy <subramanya.swamy.linux@gmail.com>
---
 Documentation/admin-guide/sysctl/kernel.rst | 9 ++++-----
 io_uring/io_uring.c                         | 8 ++++++--
 2 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/Documentation/admin-guide/sysctl/kernel.rst b/Documentation/admin-guide/sysctl/kernel.rst
index 6584a1f9bfe3..3f96007aa971 100644
--- a/Documentation/admin-guide/sysctl/kernel.rst
+++ b/Documentation/admin-guide/sysctl/kernel.rst
@@ -469,11 +469,10 @@ shrinks the kernel's attack surface.
 io_uring_group
 ==============
 
-When io_uring_disabled is set to 1, a process must either be
-privileged (CAP_SYS_ADMIN) or be in the io_uring_group group in order
-to create an io_uring instance.  If io_uring_group is set to -1 (the
-default), only processes with the CAP_SYS_ADMIN capability may create
-io_uring instances.
+When io_uring_disabled is set to 1, only processes with the
+CAP_SYS_ADMIN may create io_uring instances or process must be in the
+io_uring_group group in order to create an io_uring_instance.
+io_uring_group is set to 0.This is the default setting.
 
 
 kexec_load_disabled
diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index 09b6d860deba..0ed91b69643d 100644
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -146,7 +146,9 @@ static void io_queue_sqe(struct io_kiocb *req);
 struct kmem_cache *req_cachep;
 
 static int __read_mostly sysctl_io_uring_disabled;
-static int __read_mostly sysctl_io_uring_group = -1;
+static unsigned int __read_mostly sysctl_io_uring_group;
+static unsigned int min_gid;
+static unsigned int max_gid  = 4294967294;  /*4294967294 is the max guid*/
 
 #ifdef CONFIG_SYSCTL
 static struct ctl_table kernel_io_uring_disabled_table[] = {
@@ -164,7 +166,9 @@ static struct ctl_table kernel_io_uring_disabled_table[] = {
 		.data		= &sysctl_io_uring_group,
 		.maxlen		= sizeof(gid_t),
 		.mode		= 0644,
-		.proc_handler	= proc_dointvec,
+		.proc_handler	= proc_douintvec_minmax,
+		.extra1         = &min_gid,
+		.extra2         = &max_gid,
 	},
 	{},
 };
-- 
2.34.1

Re: [PATCH] iouring:added boundary value check for io_uring_group systl

[Jeff Moyer]

Subramanya Swamy <subramanya.swamy.linux@gmail.com> writes:

> /proc/sys/kernel/io_uring_group takes gid as input
> added boundary value check to accept gid in range of
> 0<=gid<=4294967294 & Documentation is updated for same

Thanks for the patch.  You're right, the current code artificially
limits the maximum group id.

> Signed-off-by: Subramanya Swamy <subramanya.swamy.linux@gmail.com>
> ---
>  Documentation/admin-guide/sysctl/kernel.rst | 9 ++++-----
>  io_uring/io_uring.c                         | 8 ++++++--
>  2 files changed, 10 insertions(+), 7 deletions(-)
>
> diff --git a/Documentation/admin-guide/sysctl/kernel.rst b/Documentation/admin-guide/sysctl/kernel.rst
> index 6584a1f9bfe3..3f96007aa971 100644
> --- a/Documentation/admin-guide/sysctl/kernel.rst
> +++ b/Documentation/admin-guide/sysctl/kernel.rst
> @@ -469,11 +469,10 @@ shrinks the kernel's attack surface.
>  io_uring_group
>  ==============
>  
> -When io_uring_disabled is set to 1, a process must either be
> -privileged (CAP_SYS_ADMIN) or be in the io_uring_group group in order
> -to create an io_uring instance.  If io_uring_group is set to -1 (the
> -default), only processes with the CAP_SYS_ADMIN capability may create
> -io_uring instances.
> +When io_uring_disabled is set to 1, only processes with the
> +CAP_SYS_ADMIN may create io_uring instances or process must be in the
> +io_uring_group group in order to create an io_uring_instance.
> +io_uring_group is set to 0.This is the default setting.

You are changing the default from an invalid group to the root group.  I
guess that's ok, but I'd rather keep it the way it is.  The text is a
bit repetitive.  Why not just this?

"When io_uring_disabled is set to 1, a process must either be
 privileged (CAP_SYS_ADMIN) or be in the io_uring_group group in order
 to create an io_uring instance."

> diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
> index 09b6d860deba..0ed91b69643d 100644
> --- a/io_uring/io_uring.c
> +++ b/io_uring/io_uring.c
> @@ -146,7 +146,9 @@ static void io_queue_sqe(struct io_kiocb *req);
>  struct kmem_cache *req_cachep;
>  
>  static int __read_mostly sysctl_io_uring_disabled;
> -static int __read_mostly sysctl_io_uring_group = -1;
> +static unsigned int __read_mostly sysctl_io_uring_group;
> +static unsigned int min_gid;
> +static unsigned int max_gid  = 4294967294;  /*4294967294 is the max guid*/

Right, INVALID_GID is -1.

>  #ifdef CONFIG_SYSCTL
>  static struct ctl_table kernel_io_uring_disabled_table[] = {
> @@ -164,7 +166,9 @@ static struct ctl_table kernel_io_uring_disabled_table[] = {
>  		.data		= &sysctl_io_uring_group,
>  		.maxlen		= sizeof(gid_t),
>  		.mode		= 0644,
> -		.proc_handler	= proc_dointvec,
> +		.proc_handler	= proc_douintvec_minmax,
> +		.extra1         = &min_gid,

This should be SYSCTL_ZERO.

> +		.extra2         = &max_gid,
>  	},
>  	{},
>  };

Thanks!
Jeff

Re: [PATCH] iouring:added boundary value check for io_uring_group systl

[kernel test robot]

Hi Subramanya,

kernel test robot noticed the following build warnings:

[auto build test WARNING on akpm-mm/mm-everything]
[also build test WARNING on linus/master v6.7 next-20240112]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Subramanya-Swamy/iouring-added-boundary-value-check-for-io_uring_group-systl/20240115-205112
base:   https://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git mm-everything
patch link:    https://lore.kernel.org/r/20240115124925.1735-1-subramanya.swamy.linux%40gmail.com
patch subject: [PATCH] iouring:added boundary value check for io_uring_group systl
config: sparc-randconfig-r122-20240116 (https://download.01.org/0day-ci/archive/20240117/202401170507.IOhrswHN-lkp@intel.com/config)
compiler: sparc-linux-gcc (GCC) 13.2.0
reproduce: (https://download.01.org/0day-ci/archive/20240117/202401170507.IOhrswHN-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202401170507.IOhrswHN-lkp@intel.com/

All warnings (new ones prefixed by >>):

>> io_uring/io_uring.c:158:21: warning: 'max_gid' defined but not used [-Wunused-variable]
     158 | static unsigned int max_gid  = 4294967294;  /*4294967294 is the max guid*/
         |                     ^~~~~~~
>> io_uring/io_uring.c:157:21: warning: 'min_gid' defined but not used [-Wunused-variable]
     157 | static unsigned int min_gid;
         |                     ^~~~~~~


vim +/max_gid +158 io_uring/io_uring.c

   154	
   155	static int __read_mostly sysctl_io_uring_disabled;
   156	static unsigned int __read_mostly sysctl_io_uring_group;
 > 157	static unsigned int min_gid;
 > 158	static unsigned int max_gid  = 4294967294;  /*4294967294 is the max guid*/
   159	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [PATCH] iouring:added boundary value check for io_uring_group systl

[Jens Axboe]

On 1/15/24 5:49 AM, Subramanya Swamy wrote:
> diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
> index 09b6d860deba..0ed91b69643d 100644
> --- a/io_uring/io_uring.c
> +++ b/io_uring/io_uring.c
> @@ -146,7 +146,9 @@ static void io_queue_sqe(struct io_kiocb *req);
>  struct kmem_cache *req_cachep;
>  
>  static int __read_mostly sysctl_io_uring_disabled;
> -static int __read_mostly sysctl_io_uring_group = -1;
> +static unsigned int __read_mostly sysctl_io_uring_group;
> +static unsigned int min_gid;
> +static unsigned int max_gid  = 4294967294;  /*4294967294 is the max guid*/

As per the compile bot, these need to be under CONFIG_SYSCTL. I'd
recommend just moving them a few lines further down to do that.

I think this would be cleaner:

static unsigned int max_gid = ((gid_t) ~0U) - 1;

however, as it explains why the value is what it is rather than being
some magic constant.

-- 
Jens Axboe

Re: [PATCH] iouring:added boundary value check for io_uring_group systl

[kernel test robot]

Hi Subramanya,

kernel test robot noticed the following build warnings:

[auto build test WARNING on akpm-mm/mm-everything]
[also build test WARNING on linus/master v6.7 next-20240119]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Subramanya-Swamy/iouring-added-boundary-value-check-for-io_uring_group-systl/20240115-205112
base:   https://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git mm-everything
patch link:    https://lore.kernel.org/r/20240115124925.1735-1-subramanya.swamy.linux%40gmail.com
patch subject: [PATCH] iouring:added boundary value check for io_uring_group systl
config: i386-buildonly-randconfig-002-20240116 (https://download.01.org/0day-ci/archive/20240120/202401202013.dEvDNaAX-lkp@intel.com/config)
compiler: ClangBuiltLinux clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240120/202401202013.dEvDNaAX-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202401202013.dEvDNaAX-lkp@intel.com/

All warnings (new ones prefixed by >>):

>> io_uring/io_uring.c:157:21: warning: unused variable 'min_gid' [-Wunused-variable]
     157 | static unsigned int min_gid;
         |                     ^~~~~~~
>> io_uring/io_uring.c:158:21: warning: unused variable 'max_gid' [-Wunused-variable]
     158 | static unsigned int max_gid  = 4294967294;  /*4294967294 is the max guid*/
         |                     ^~~~~~~
   2 warnings generated.


vim +/min_gid +157 io_uring/io_uring.c

   154	
   155	static int __read_mostly sysctl_io_uring_disabled;
   156	static unsigned int __read_mostly sysctl_io_uring_group;
 > 157	static unsigned int min_gid;
 > 158	static unsigned int max_gid  = 4294967294;  /*4294967294 is the max guid*/
   159	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [PATCH] iouring:added boundary value check for io_uring_group systl

[Subramanya Swamy]

Hi Jeff,

            Thank you for reviewing the patch.

On 16/01/24 23:16, Jeff Moyer wrote:
> Subramanya Swamy <subramanya.swamy.linux@gmail.com> writes:
>
>> /proc/sys/kernel/io_uring_group takes gid as input
>> added boundary value check to accept gid in range of
>> 0<=gid<=4294967294 & Documentation is updated for same
> Thanks for the patch.  You're right, the current code artificially
> limits the maximum group id.
>
>> Signed-off-by: Subramanya Swamy <subramanya.swamy.linux@gmail.com>
>> ---
>>   Documentation/admin-guide/sysctl/kernel.rst | 9 ++++-----
>>   io_uring/io_uring.c                         | 8 ++++++--
>>   2 files changed, 10 insertions(+), 7 deletions(-)
>>
>> diff --git a/Documentation/admin-guide/sysctl/kernel.rst b/Documentation/admin-guide/sysctl/kernel.rst
>> index 6584a1f9bfe3..3f96007aa971 100644
>> --- a/Documentation/admin-guide/sysctl/kernel.rst
>> +++ b/Documentation/admin-guide/sysctl/kernel.rst
>> @@ -469,11 +469,10 @@ shrinks the kernel's attack surface.
>>   io_uring_group
>>   ==============
>>   
>> -When io_uring_disabled is set to 1, a process must either be
>> -privileged (CAP_SYS_ADMIN) or be in the io_uring_group group in order
>> -to create an io_uring instance.  If io_uring_group is set to -1 (the
>> -default), only processes with the CAP_SYS_ADMIN capability may create
>> -io_uring instances.
>> +When io_uring_disabled is set to 1, only processes with the
>> +CAP_SYS_ADMIN may create io_uring instances or process must be in the
>> +io_uring_group group in order to create an io_uring_instance.
>> +io_uring_group is set to 0.This is the default setting.
> You are changing the default from an invalid group to the root group.  I
> guess that's ok, but I'd rather keep it the way it is.  The text is a
> bit repetitive.  Why not just this?
>
> "When io_uring_disabled is set to 1, a process must either be
>   privileged (CAP_SYS_ADMIN) or be in the io_uring_group group in order
>   to create an io_uring instance."

Yes this looks neat , will add in v2

>> diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
>> index 09b6d860deba..0ed91b69643d 100644
>> --- a/io_uring/io_uring.c
>> +++ b/io_uring/io_uring.c
>> @@ -146,7 +146,9 @@ static void io_queue_sqe(struct io_kiocb *req);
>>   struct kmem_cache *req_cachep;
>>   
>>   static int __read_mostly sysctl_io_uring_disabled;
>> -static int __read_mostly sysctl_io_uring_group = -1;
>> +static unsigned int __read_mostly sysctl_io_uring_group;
>> +static unsigned int min_gid;
>> +static unsigned int max_gid  = 4294967294;  /*4294967294 is the max guid*/
> Right, INVALID_GID is -1.
>
>>   #ifdef CONFIG_SYSCTL
>>   static struct ctl_table kernel_io_uring_disabled_table[] = {
>> @@ -164,7 +166,9 @@ static struct ctl_table kernel_io_uring_disabled_table[] = {
>>   		.data		= &sysctl_io_uring_group,
>>   		.maxlen		= sizeof(gid_t),
>>   		.mode		= 0644,
>> -		.proc_handler	= proc_dointvec,
>> +		.proc_handler	= proc_douintvec_minmax,
>> +		.extra1         = &min_gid,
> This should be SYSCTL_ZERO.

will change this to SYSCTL_ZERO in v2

>> +		.extra2         = &max_gid,
>>   	},
>>   	{},
>>   };
> Thanks!
> Jeff
>
-- 
Best Regards
Subramanya

Re: [PATCH] iouring:added boundary value check for io_uring_group systl

[Subramanya Swamy]

Hi Jens,

            Thank you for reviewing the patch.

On 17/01/24 03:02, Jens Axboe wrote:
> On 1/15/24 5:49 AM, Subramanya Swamy wrote:
>> diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
>> index 09b6d860deba..0ed91b69643d 100644
>> --- a/io_uring/io_uring.c
>> +++ b/io_uring/io_uring.c
>> @@ -146,7 +146,9 @@ static void io_queue_sqe(struct io_kiocb *req);
>>   struct kmem_cache *req_cachep;
>>   
>>   static int __read_mostly sysctl_io_uring_disabled;
>> -static int __read_mostly sysctl_io_uring_group = -1;
>> +static unsigned int __read_mostly sysctl_io_uring_group;
>> +static unsigned int min_gid;
>> +static unsigned int max_gid  = 4294967294;  /*4294967294 is the max guid*/
> As per the compile bot, these need to be under CONFIG_SYSCTL. I'd
> recommend just moving them a few lines further down to do that.
>
> I think this would be cleaner:
>
> static unsigned int max_gid = ((gid_t) ~0U) - 1;
>
> however, as it explains why the value is what it is rather than being
> some magic constant.
Will add these changes in v2

-- 
Best Regards
Subramanya