ACK: [SRU H/I/OEM-5.10 1/1] io_uring: ensure symmetry in handling iter types in loop_rw_iter()

[Stefan Bader]

On 20.09.21 15:33, Thadeu Lima de Souza Cascardo wrote:
> From: Jens Axboe <axboe at kernel.dk>
> 
> When setting up the next segment, we check what type the iter is and
> handle it accordingly. However, when incrementing and processed amount
> we do not, and both iter advance and addr/len are adjusted, regardless
> of type. Split the increment side just like we do on the setup side.
> 
> Fixes: 4017eb91a9e7 ("io_uring: make loop_rw_iter() use original user supplied pointers")
> Cc: stable at vger.kernel.org
> Reported-by: Valentina Palmiotti <vpalmiotti at gmail.com>
> Reviewed-by: Pavel Begunkov <asml.silence at gmail.com>
> Signed-off-by: Jens Axboe <axboe at kernel.dk>
> (cherry picked from commit 16c8d2df7ec0eed31b7d3b61cb13206a7fb930cc)
> CVE-2021-41073
> Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo at canonical.com>
Acked-by: Stefan Bader <stefan.bader at canonical.com>
> ---
>   fs/io_uring.c | 9 ++++++---
>   1 file changed, 6 insertions(+), 3 deletions(-)
> 
> diff --git a/fs/io_uring.c b/fs/io_uring.c
> index e1e1acc4be15..b4e9b68fe196 100644
> --- a/fs/io_uring.c
> +++ b/fs/io_uring.c
> @@ -3309,12 +3309,15 @@ static ssize_t loop_rw_iter(int rw, struct io_kiocb *req, struct iov_iter *iter)
>   				ret = nr;
>   			break;
>   		}
> +		if (!iov_iter_is_bvec(iter)) {
> +			iov_iter_advance(iter, nr);
> +		} else {
> +			req->rw.len -= nr;
> +			req->rw.addr += nr;
> +		}
>   		ret += nr;
>   		if (nr != iovec.iov_len)
>   			break;
> -		req->rw.len -= nr;
> -		req->rw.addr += nr;
> -		iov_iter_advance(iter, nr);
>   	}
>   
>   	return ret;
> 


-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20210920/4aa4d05e/attachment.sig>