public inbox for [email protected]
 help / color / mirror / Atom feed
* [PATCH 5.10] io_uring: fix recvmsg setup with compat buf-select
@ 2020-11-29 18:33 Pavel Begunkov
  2020-11-30 18:12 ` Jens Axboe
  0 siblings, 1 reply; 5+ messages in thread
From: Pavel Begunkov @ 2020-11-29 18:33 UTC (permalink / raw)
  To: Jens Axboe, io-uring; +Cc: stable

__io_compat_recvmsg_copy_hdr() with REQ_F_BUFFER_SELECT reads out iov
len but never assigns it to iov/fast_iov, leaving sr->len with garbage.
Hopefully, following io_buffer_select() truncates it to the selected
buffer size, but the value is still may be under what was specified.

Cc: <[email protected]> # 5.7
Signed-off-by: Pavel Begunkov <[email protected]>
---
 fs/io_uring.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 1023f7b44cea..a2a7c65a77aa 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -4499,7 +4499,8 @@ static int __io_compat_recvmsg_copy_hdr(struct io_kiocb *req,
 			return -EFAULT;
 		if (clen < 0)
 			return -EINVAL;
-		sr->len = iomsg->iov[0].iov_len;
+		sr->len = clen;
+		iomsg->iov[0].iov_len = clen;
 		iomsg->iov = NULL;
 	} else {
 		ret = __import_iovec(READ, (struct iovec __user *)uiov, len,
-- 
2.24.0


^ permalink raw reply related	[flat|nested] 5+ messages in thread

* Re: [PATCH 5.10] io_uring: fix recvmsg setup with compat buf-select
  2020-11-29 18:33 [PATCH 5.10] io_uring: fix recvmsg setup with compat buf-select Pavel Begunkov
@ 2020-11-30 18:12 ` Jens Axboe
  2020-12-02 22:04   ` Pavel Begunkov
  0 siblings, 1 reply; 5+ messages in thread
From: Jens Axboe @ 2020-11-30 18:12 UTC (permalink / raw)
  To: Pavel Begunkov, io-uring; +Cc: stable

On 11/29/20 11:33 AM, Pavel Begunkov wrote:
> __io_compat_recvmsg_copy_hdr() with REQ_F_BUFFER_SELECT reads out iov
> len but never assigns it to iov/fast_iov, leaving sr->len with garbage.
> Hopefully, following io_buffer_select() truncates it to the selected
> buffer size, but the value is still may be under what was specified.

Applied, thanks.

-- 
Jens Axboe


^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: [PATCH 5.10] io_uring: fix recvmsg setup with compat buf-select
  2020-11-30 18:12 ` Jens Axboe
@ 2020-12-02 22:04   ` Pavel Begunkov
  2020-12-02 23:24     ` Jens Axboe
  0 siblings, 1 reply; 5+ messages in thread
From: Pavel Begunkov @ 2020-12-02 22:04 UTC (permalink / raw)
  To: Jens Axboe, io-uring; +Cc: stable

On 30/11/2020 18:12, Jens Axboe wrote:
> On 11/29/20 11:33 AM, Pavel Begunkov wrote:
>> __io_compat_recvmsg_copy_hdr() with REQ_F_BUFFER_SELECT reads out iov
>> len but never assigns it to iov/fast_iov, leaving sr->len with garbage.
>> Hopefully, following io_buffer_select() truncates it to the selected
>> buffer size, but the value is still may be under what was specified.
> 
> Applied, thanks.

Jens, apologies but where did it go? Can't find at git.kernel.dk

-- 
Pavel Begunkov

^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: [PATCH 5.10] io_uring: fix recvmsg setup with compat buf-select
  2020-12-02 22:04   ` Pavel Begunkov
@ 2020-12-02 23:24     ` Jens Axboe
  2020-12-03  0:41       ` Pavel Begunkov
  0 siblings, 1 reply; 5+ messages in thread
From: Jens Axboe @ 2020-12-02 23:24 UTC (permalink / raw)
  To: Pavel Begunkov, io-uring; +Cc: stable

On 12/2/20 3:04 PM, Pavel Begunkov wrote:
> On 30/11/2020 18:12, Jens Axboe wrote:
>> On 11/29/20 11:33 AM, Pavel Begunkov wrote:
>>> __io_compat_recvmsg_copy_hdr() with REQ_F_BUFFER_SELECT reads out iov
>>> len but never assigns it to iov/fast_iov, leaving sr->len with garbage.
>>> Hopefully, following io_buffer_select() truncates it to the selected
>>> buffer size, but the value is still may be under what was specified.
>>
>> Applied, thanks.
> 
> Jens, apologies but where did it go? Can't find at git.kernel.dk

Looks like I forgot to push it out, but it did get applied to
io_uring-5.10. My git box is having an issue right now, so can't even
push it out... Will do so tomorrow morning.

-- 
Jens Axboe


^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: [PATCH 5.10] io_uring: fix recvmsg setup with compat buf-select
  2020-12-02 23:24     ` Jens Axboe
@ 2020-12-03  0:41       ` Pavel Begunkov
  0 siblings, 0 replies; 5+ messages in thread
From: Pavel Begunkov @ 2020-12-03  0:41 UTC (permalink / raw)
  To: Jens Axboe, io-uring; +Cc: stable

On 02/12/2020 23:24, Jens Axboe wrote:
> On 12/2/20 3:04 PM, Pavel Begunkov wrote:
>> On 30/11/2020 18:12, Jens Axboe wrote:
>>> On 11/29/20 11:33 AM, Pavel Begunkov wrote:
>>>> __io_compat_recvmsg_copy_hdr() with REQ_F_BUFFER_SELECT reads out iov
>>>> len but never assigns it to iov/fast_iov, leaving sr->len with garbage.
>>>> Hopefully, following io_buffer_select() truncates it to the selected
>>>> buffer size, but the value is still may be under what was specified.
>>>
>>> Applied, thanks.
>>
>> Jens, apologies but where did it go? Can't find at git.kernel.dk
> 
> Looks like I forgot to push it out, but it did get applied to
> io_uring-5.10. My git box is having an issue right now, so can't even
> push it out... Will do so tomorrow morning.

That's ok, just trying to keep track. Sorry for bothering

-- 
Pavel Begunkov

^ permalink raw reply	[flat|nested] 5+ messages in thread

end of thread, other threads:[~2020-12-03  0:46 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-11-29 18:33 [PATCH 5.10] io_uring: fix recvmsg setup with compat buf-select Pavel Begunkov
2020-11-30 18:12 ` Jens Axboe
2020-12-02 22:04   ` Pavel Begunkov
2020-12-02 23:24     ` Jens Axboe
2020-12-03  0:41       ` Pavel Begunkov

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox