From patchwork Mon Sep 19 17:58:09 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Thadeu Lima de Souza Cascardo X-Patchwork-Id: 1679597 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=91.189.94.19; helo=huckleberry.canonical.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=) Authentication-Results: legolas.ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=canonical.com header.i=@canonical.com header.a=rsa-sha256 header.s=20210705 header.b=lSXfdEbr; dkim-atps=neutral Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4MWXVk50scz1yp7 for ; Tue, 20 Sep 2022 03:59:10 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.86_2) (envelope-from ) id 1oaL2q-0007Mr-R7; Mon, 19 Sep 2022 17:59:00 +0000 Received: from smtp-relay-canonical-1.internal ([10.131.114.174] helo=smtp-relay-canonical-1.canonical.com) by huckleberry.canonical.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1oaL2f-0006y5-If for kernel-team@lists.ubuntu.com; Mon, 19 Sep 2022 17:58:49 +0000 Received: from quatroqueijos.. (unknown [179.93.171.162]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-canonical-1.canonical.com (Postfix) with ESMTPSA id 0F6873FDEF for ; Mon, 19 Sep 2022 17:58:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com; s=20210705; t=1663610327; bh=g7zmu3V0F8Y+j9dwTxvtswUf0ghguPFl3T4z3viCMU4=; h=From:To:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=lSXfdEbra3N6E3Bd/jCXdfhh9aQuPo1CU/m/IJCQ5B7wM95REg/C4Xn7Hct/YdlhY A6/VatyTWhrtdORKZgm2TXTm3Awq1VLrVOBnSgEWSnvnJU+A+LsFNIowrxtH+rBQyz EKB4rd0rlMQSvKe6D+sHCCMSQKiFfpZT6ZKPGPMU7FwSI2xk6TZ1TnqGhmp1uUn+cN xItfBTJtMVwyNZAeAOJzhuiJA93H2Socf9/pVL18/alAuqgMXPE2k4ObnYSsg5D/PN pCYJJAWvwSaEQ5E62+xOyBAU0RfArz9ZCvLxLTxW4XSbxbKOYgQdZiQe6fMf9BnFfG Yoo3x88XSLLSQ== From: Thadeu Lima de Souza Cascardo To: kernel-team@lists.ubuntu.com Subject: [SRU Jammy 11/12] io_uring: fix wrong arm_poll error handling Date: Mon, 19 Sep 2022 14:58:09 -0300 Message-Id: <20220919175810.689086-13-cascardo@canonical.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220919175810.689086-1-cascardo@canonical.com> References: <20220919175810.689086-1-cascardo@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Pavel Begunkov [ upstream commmit 9d2ad2947a53abf5e5e6527a9eeed50a3a4cbc72 ] Leaving ip.error set when a request was punted to task_work execution is problematic, don't forget to clear it. Fixes: aa43477b04025 ("io_uring: poll rework") Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/a6c84ef4182c6962380aebe11b35bdcb25b0ccfb.1655852245.git.asml.silence@gmail.com Signed-off-by: Jens Axboe [pavel: backport] Signed-off-by: Pavel Begunkov Signed-off-by: Greg Kroah-Hartman (cherry picked from commit 182dc3aa5ae2f6e2ec6a95667845a819179a78e8 linux-5.15.y) CVE-2022-3176 Signed-off-by: Thadeu Lima de Souza Cascardo --- fs/io_uring.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/io_uring.c b/fs/io_uring.c index 0a14cb2c55c5..5ce0254d2cbe 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -5627,8 +5627,10 @@ static int __io_arm_poll_handler(struct io_kiocb *req, if (mask) { /* can't multishot if failed, just queue the event we've got */ - if (unlikely(ipt->error || !ipt->nr_entries)) + if (unlikely(ipt->error || !ipt->nr_entries)) { poll->events |= EPOLLONESHOT; + ipt->error = 0; + } __io_poll_execute(req, mask); return 0; }