Message-ID: <95ea9142-9f36-981d-a04d-3efded544af7@gmail.com>
Date:   Tue, 7 Dec 2021 17:36:24 +0000
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
 Thunderbird/91.3.2
Subject: Re: [PATCH 0/2] Revert "block: add single bio async direct IO helper"
 to avoid UAF
Content-Language: en-US
To:     George Kennedy <george.kennedy@oracle.com>,
        gregkh@linuxfoundation.org, axboe@kernel.dk
Cc:     linux-block@vger.kernel.org, linux-kernel@vger.kernel.org
References: <1638892302-14475-1-git-send-email-george.kennedy@oracle.com>
From:   Pavel Begunkov <asml.silence@gmail.com>
In-Reply-To: <1638892302-14475-1-git-send-email-george.kennedy@oracle.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 12/7/21 15:51, George Kennedy wrote:
> git bisect shows that commit 54a88eb838d3
> ("block: add single bio async direct IO helper")
> causes the following UAF: KASAN: use-after-free Write in io_submit_one
> 
> Tried to root-cause the issue, but need the patch submitter's help in
> coming up with a fix.

Hey George, thanks for the report. Do you have a reproducer?

One spot I don't like is how errors from bio_iov_iter_get_pages()
are handled, will test it.

diff --git a/block/fops.c b/block/fops.c
index ad732a36f9b3..211f44974d1e 100644
--- a/block/fops.c
+++ b/block/fops.c
@@ -342,7 +342,7 @@ static ssize_t __blkdev_direct_IO_async(struct kiocb *iocb,
  		if (unlikely(ret)) {
  			bio->bi_status = BLK_STS_IOERR;
  			bio_endio(bio);
-			return ret;
+			return -EIOCBQUEUED;
  		}
  	}
  	dio->size = bio->bi_iter.bi_size;


-- 
Pavel Begunkov