From:   George Kennedy <george.kennedy@oracle.com>
To:     gregkh@linuxfoundation.org, axboe@kernel.dk, asml.silence@gmail.com
Cc:     george.kennedy@oracle.com, linux-block@vger.kernel.org,
        linux-kernel@vger.kernel.org
Subject: [PATCH 0/2] Revert "block: add single bio async direct IO helper" to avoid UAF
Date:   Tue,  7 Dec 2021 10:51:40 -0500
Message-Id: <1638892302-14475-1-git-send-email-george.kennedy@oracle.com>
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?HN8VsYGVPLfuNdGG84BYK0S33XNBoqh8m/EqAr5Ch50K/n42dmM4/d6JWT+a?=
 =?us-ascii?Q?OW2hHGLghTECMfacnlufUsQrRS5Y+gTpbo3Vuoivtt02yfXRO7VvkqmRRs5Z?=
 =?us-ascii?Q?oVwtzngn+eOZDf2UjAjIoLe9bVXrtMxv9mhwkSXq1JOgURFjSNk/82d3f7wK?=
 =?us-ascii?Q?SFez47v3tkgOM1cMjfEFUZC1/aVwSLk4ESwU2Z74vq2e7l9a1PTvhuydBxz/?=
 =?us-ascii?Q?iBVYKW63AT1cEXDus5VZu5nFK9loka7nTYmBKFeKf/dZ3kClg6KvMXunJ7M6?=
 =?us-ascii?Q?+9SZWW2+US8tnVICjyR8ewLGtY/B8Wp0+OngwezEoYc9o8hH2//mIVrsBx9X?=
 =?us-ascii?Q?YmSmLePAPinYxeDl2O9bO5CRg7NDJ0pbpXdWF536fKZ4U9J7DQkpQiCrm06X?=
 =?us-ascii?Q?j6tAgcVE7RHUBKuK2ZF2qg97WFG+B4A17NJxxbLCyG802OJGKqqVe7yiC7qv?=
 =?us-ascii?Q?zD+1RwVZA201wK94YMIKX1uC0DiqGzbG+KzC3T5FoFP319rQnJRQDCIEckVD?=
 =?us-ascii?Q?s+p8Dfx9Ta/oN3UxKo4zHD0WkwpkE7I/04Sa87OOTYuUS3gVkzWA52z9txYz?=
 =?us-ascii?Q?KRsk9VTHnqV/iMae9I96niWdPACKhXy1gN0+4AW122+VfA0ZLpi9x7coo18k?=
 =?us-ascii?Q?QpYdOyYyuR3aAi8qLpcJgAcDhHA+v12f5+8OTX+fdl+VBQuXqH7Ly5F2BACn?=
 =?us-ascii?Q?/hQcmmLowsdH3xmN8tPvKV+eHF9IwRfl5lmnjdd3mPfVgJbgLY7M+3mJa3nG?=
 =?us-ascii?Q?VT3yIaegqUanAvWWPXbx/KSLj576u/e3fTE7oiY9E3SYqNI17ytJh7aCkkZn?=
 =?us-ascii?Q?hGc81bJKtrx4M9z5H+GJpdH5uZkbvOoD7Vhh2tyufGxey1GYqXRaxdUONMYV?=
 =?us-ascii?Q?YprBJSOT6uyPixNurD5l1Qk/d7pxYwb66JBUrv9/0VnzHHYRGb/jQ3Gye6ES?=
 =?us-ascii?Q?9yGtyBIiDi6IN6WLhGEtjCqvMw5t72Px8BLd/qDVqO3BKaXDb8lHGC+Qwi0B?=
 =?us-ascii?Q?ZRf3NY2XgJ4JA5osOt8bGkA0tEEzj5akPGoHmAiM2wGP9X+kW1E13uwWXDn8?=
 =?us-ascii?Q?a+QqWPU05NJEXsiZJZcYH2gHXFxTu1cUlx5prrbWCfHcMIIYgscDiqiUM2x0?=
 =?us-ascii?Q?0QSjw3fL41v60uPM3zjR+v0VLaDD/t6zzu6vt1LZG5aRTHJH2nxyCNsXCwBN?=
 =?us-ascii?Q?w/NDacjrNG+suLrBrbjP6gdDn75iVau49R65VbLvFkfJIOlC4m34cXjg/Lzf?=
 =?us-ascii?Q?/wu2Hel7gnQZhZTX4NwMaKhFXtvIpiMGMv7BXxT85gLp5JfOKG/S5z/Wb3DD?=
 =?us-ascii?Q?rsaFVXoRh+rL11PV+qGaXipuhhFz3pdAeafw7H6uU5yD+Trqmvwl06TOdRR2?=
 =?us-ascii?Q?F8JX4GnMCco/HCUfwCihH2N9mx+Y0Xo5mIOR5wkjW0vkOpGqFdzseD/YgyLK?=
 =?us-ascii?Q?AHQ18yrlrScHnHaHLyx1dZojZ1DnLqEp1n0ibYe0NOvP2u8KiA/aIICR06rG?=
 =?us-ascii?Q?Fvmma/zEeEGOC/2MWo/YRUDhh30hH849dM82pfZahJVXKFaCiIoS7AusGju7?=
 =?us-ascii?Q?wb2aHmodoLa8uW3fM6dI6Lle9PlVIyzdPGTfA29Cb4XawbWsIlZ3pDka7KBM?=
 =?us-ascii?Q?jr57PX5xkjZfal8OZO2NudPQpshvVrdjQT+4ZOz0zprP+YPJHvA0h9+vDQky?=
 =?us-ascii?Q?lWTKqA=3D=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 42ed4f6f-e7c1-421c-e73e-08d9b999bdd6
X-MS-Exchange-CrossTenant-AuthSource: BN0PR10MB5192.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Dec 2021 15:53:41.7479
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 0ydVLmn8/skfv3fTknEaJ068AOflEOb2a1a6GhLPi9jCAtEss0m8Df6vFDzsDyct3Wiss/MlC1LpcgLVFbQPBQNHm2r1a07lBh8grMP3RgE=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN7PR10MB2467
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10190 signatures=668683
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxlogscore=622 mlxscore=0 spamscore=0
 phishscore=0 bulkscore=0 suspectscore=0 malwarescore=0 adultscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000
 definitions=main-2112070097
X-Proofpoint-ORIG-GUID: 0olkuLCspT9sxT0HVKUFEKIR2fn2zafO
X-Proofpoint-GUID: 0olkuLCspT9sxT0HVKUFEKIR2fn2zafO
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

git bisect shows that commit 54a88eb838d3
("block: add single bio async direct IO helper")
causes the following UAF: KASAN: use-after-free Write in io_submit_one

Tried to root-cause the issue, but need the patch submitter's help in
coming up with a fix.

Needed to revert commit 1bb6b8102945
("block: avoid extra iter advance with async iocb")
in order to be able to revert 54a88eb838d37af930c9f19e1930a4fba6789cb5.

George Kennedy (2):
  Revert "block: avoid extra iter advance with async iocb"
  Revert "block: add single bio async direct IO helper"

 block/bio.c         |  2 +-
 block/fops.c        | 96 ++---------------------------------------------------
 include/linux/bio.h |  1 -
 3 files changed, 4 insertions(+), 95 deletions(-)

-- 
1.8.3.1