public inbox for [email protected]
 help / color / mirror / Atom feed
From: Pavel Begunkov <[email protected]>
To: Jens Axboe <[email protected]>, [email protected]
Subject: [PATCH 5.13] io_uring: fix NULL reg-buffer
Date: Mon, 26 Apr 2021 15:17:38 +0100	[thread overview]
Message-ID: <830020f9c387acddd51962a3123b5566571b8c6d.1619446608.git.asml.silence@gmail.com> (raw)

io_import_fixed() doesn't expect a registered buffer slot to be NULL and
would fail stumbling on it. We don't allow it, but if during
__io_sqe_buffers_update() rsrc removal succeeds but following register
fails, we'll get such a situation.

Do it atomically and don't remove buffers until we sure that a new one
can be set.

Fixes: 634d00df5e1cf ("io_uring: add full-fledged dynamic buffers support")
Signed-off-by: Pavel Begunkov <[email protected]>
---
 fs/io_uring.c | 34 +++++++++++++++++-----------------
 1 file changed, 17 insertions(+), 17 deletions(-)

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 6b578c380e73..863420e184cf 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -8419,7 +8419,6 @@ static int __io_sqe_buffers_update(struct io_ring_ctx *ctx,
 {
 	u64 __user *tags = u64_to_user_ptr(up->tags);
 	struct iovec iov, __user *iovs = u64_to_user_ptr(up->data);
-	struct io_mapped_ubuf *imu;
 	struct page *last_hpage = NULL;
 	bool needs_switch = false;
 	__u32 done;
@@ -8431,6 +8430,8 @@ static int __io_sqe_buffers_update(struct io_ring_ctx *ctx,
 		return -EINVAL;
 
 	for (done = 0; done < nr_args; done++) {
+		struct io_mapped_ubuf *imu;
+		int offset = up->offset + done;
 		u64 tag = 0;
 
 		err = io_copy_iov(ctx, &iov, iovs, done);
@@ -8440,28 +8441,27 @@ static int __io_sqe_buffers_update(struct io_ring_ctx *ctx,
 			err = -EFAULT;
 			break;
 		}
+		err = io_buffer_validate(&iov);
+		if (err)
+			break;
+		err = io_sqe_buffer_register(ctx, &iov, &imu, &last_hpage);
+		if (err)
+			break;
 
-		i = array_index_nospec(up->offset + done, ctx->nr_user_bufs);
-		imu = ctx->user_bufs[i];
-		if (imu) {
-			err = io_queue_rsrc_removal(ctx->buf_data, up->offset + done,
-						    ctx->rsrc_node, imu);
-			if (err)
+		i = array_index_nospec(offset, ctx->nr_user_bufs);
+		if (ctx->user_bufs[i]) {
+			err = io_queue_rsrc_removal(ctx->buf_data, offset,
+						    ctx->rsrc_node, ctx->user_bufs[i]);
+			if (unlikely(err)) {
+				io_buffer_unmap(ctx, &imu);
 				break;
+			}
 			ctx->user_bufs[i] = NULL;
 			needs_switch = true;
 		}
 
-		if (iov.iov_base || iov.iov_len) {
-			err = io_buffer_validate(&iov);
-			if (err)
-				break;
-			err = io_sqe_buffer_register(ctx, &iov, &ctx->user_bufs[i],
-						     &last_hpage);
-			if (err)
-				break;
-			ctx->buf_data->tags[up->offset + done] = tag;
-		}
+		ctx->user_bufs[i] = imu;
+		ctx->buf_data->tags[offset] = tag;
 	}
 
 	if (needs_switch)
-- 
2.31.1


             reply	other threads:[~2021-04-26 14:18 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-04-26 14:17 Pavel Begunkov [this message]
2021-04-26 15:04 ` [PATCH 5.13] io_uring: fix NULL reg-buffer Jens Axboe

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=830020f9c387acddd51962a3123b5566571b8c6d.1619446608.git.asml.silence@gmail.com \
    [email protected] \
    [email protected] \
    [email protected] \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox