From patchwork Sun Jan 21 20:26:34 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Christian A. Ehrhardt" X-Patchwork-Id: 189836 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:7301:2bc4:b0:101:a8e8:374 with SMTP id hx4csp2228624dyb; Sun, 21 Jan 2024 12:27:29 -0800 (PST) X-Google-Smtp-Source: AGHT+IHBSmA5FOWpxVkeSV/6XtCxPL03d5nxLNjQCJV9njvsa4h1xgaB+QuzcCxVd8emdHu6nzGX X-Received: by 2002:a92:ce0d:0:b0:361:9315:5356 with SMTP id b13-20020a92ce0d000000b0036193155356mr4947593ilo.10.1705868849040; Sun, 21 Jan 2024 12:27:29 -0800 (PST) ARC-Seal: i=2; a=rsa-sha256; t=1705868849; cv=pass; d=google.com; s=arc-20160816; b=OzTWkABefopYlu7ZvKRUOyolmg0CcmMWwtbkz1Cjd/4Jhq8YyQPfOBsO4H2QQq5vQe q7DPL5fHhhSbt/LaQ1hc3hyX5hjpoePFKSX84d5wfHYcc+mOSOPu395WKpePs4ace8FK AAu48kBsoVFmGOdt8BS36NF6dNax/0llVuZIbv6u9EvQJcAU2zA/zEA3pKpD3nkiRNiB WWcJjpTiP8xjIlHfnXqXLXpFVB68fqUSsKMHb9pRGUzcNrb5AZleEWDfIaC+XPIzwOVN 9KqLNDYhps1ItiEvg1jeXW4vtD/c4+nILhNowwR/bOAj2dh434fruNmqtlu+c/3VIYV2 L+FA== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:mime-version:list-unsubscribe :list-subscribe:list-id:precedence:message-id:date:subject:cc:to :from; bh=7GpEtLxzW+Hs+48FmDWv/RDrJkLDsKisoSIBTB5azLE=; fh=zYtzQJEiciIl3XKaQ9Ja/5SklutOKWuxMpz9yVDfBqs=; b=CN3H0jeJJ5CKC2GMiNUQAKBO1MaYuMhcgLas/OMbMEmwmsSONXGlZUTQwxvGbxDSkk kpQg6MXQlancdiHraYM8Ph4244u7jm3DQVxTNZ2dbGmQ+YkJo3iUbj9uwq4Ug9SMSb40 bLtam9Vzn+6+FB2DxXb9iRPupUSLx0nzwKDh3IdxSxY8qs1d5VkbsB1i55wImjAYoreK 8lYyoUupVqnFiag/7PBcJq8DrYRFg5zUt29JIhUR9K9G3mxYncIMejVwiw7ANW/sexoV B0tmXzIhn9D0nBaNnZnqj8lrM0OHpj2IJ6GF/5GjdfqzenIJx7+EBcd1KBL9Th5mJLFn 4GJg== ARC-Authentication-Results: i=2; mx.google.com; arc=pass (i=1 spf=pass spfdomain=c--e.de); spf=pass (google.com: domain of linux-kernel+bounces-32179-ouuuleilei=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) smtp.mailfrom="linux-kernel+bounces-32179-ouuuleilei=gmail.com@vger.kernel.org" Received: from sv.mirrors.kernel.org (sv.mirrors.kernel.org. [139.178.88.99]) by mx.google.com with ESMTPS id c2-20020a17090abf0200b00280479459f7si6910054pjs.50.2024.01.21.12.27.28 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 21 Jan 2024 12:27:29 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel+bounces-32179-ouuuleilei=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99; Authentication-Results: mx.google.com; arc=pass (i=1 spf=pass spfdomain=c--e.de); spf=pass (google.com: domain of linux-kernel+bounces-32179-ouuuleilei=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) smtp.mailfrom="linux-kernel+bounces-32179-ouuuleilei=gmail.com@vger.kernel.org" Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sv.mirrors.kernel.org (Postfix) with ESMTPS id C327E281991 for ; Sun, 21 Jan 2024 20:27:28 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 4FEC138DDA; Sun, 21 Jan 2024 20:27:14 +0000 (UTC) Received: from cae.in-ulm.de (cae.in-ulm.de [217.10.14.231]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 209C337713; Sun, 21 Jan 2024 20:27:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=217.10.14.231 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1705868832; cv=none; b=aRwVA+srv5ScTzk0sug1oz6M77CKZ2dZOYXYOescMKaOXzOVkyYWJJfBrZV/Bqp/sfCt4lWW9A6NWqKoaZqa4rCwVl6VHAOoc8nULQYbrqbJYmCKE4Xbjq5BXj3aEjObP5r+8SWiJPsqZc4Xb4i5fVmOgz3Ol61RQnCIRWABUAI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1705868832; c=relaxed/simple; bh=uZiztjpinSS7Xdrx+6z3yfBDTTHpVfueyyjwSZhYKaI=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=eopHBvg1iodqMpDfMtbmeSLfUv7CotjnhnT57vw//kzpiPqv8kBLMRCEtT0FfJJnUAGGwagWPz6KXcq8JcumDlEIFgtkAYGEqTfzXdMnmdKmnX6GfGVOL6dDfnyRCbijbv4WzPnmDL4Wp2ivl6Io4gpBQ0qkoj2ipPeASLFDd5U= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=c--e.de; spf=pass smtp.mailfrom=c--e.de; arc=none smtp.client-ip=217.10.14.231 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=c--e.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=c--e.de Received: by cae.in-ulm.de (Postfix, from userid 1000) id DBDBE1401CF; Sun, 21 Jan 2024 21:27:00 +0100 (CET) From: "Christian A. Ehrhardt" To: linux-block@vger.kernel.org, linux-kernel@vger.kernel.org Cc: "Christian A. Ehrhardt" , syzbot+a532b03fdfee2c137666@syzkaller.appspotmail.com, syzbot+63dec323ac56c28e644f@syzkaller.appspotmail.com, Jens Axboe , Andrew Morton , Alexander Viro Subject: [PATCH] block: Fix WARNING in _copy_from_iter Date: Sun, 21 Jan 2024 21:26:34 +0100 Message-Id: <20240121202634.275068-1-lk@c--e.de> X-Mailer: git-send-email 2.30.2 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1788733134001110491 X-GMAIL-MSGID: 1788733134001110491 Syzkaller reports a warning in _copy_from_iter because an iov_iter is supposedly used in the wrong direction. The reason is that syzcaller managed to generate a request with a transfer direction of SG_DXFER_TO_FROM_DEV. This instructs the kernel to copy user buffers into the kernel, read into the copied buffers and then copy the data back to user space. Thus the iovec is used in both directions. Detect this situation in the block layer and construct a new iterator with the correct direction for the copy-in. Reported-by: syzbot+a532b03fdfee2c137666@syzkaller.appspotmail.com Closes: https://lore.kernel.org/lkml/0000000000009b92c10604d7a5e9@google.com/t/ Reported-by: syzbot+63dec323ac56c28e644f@syzkaller.appspotmail.com Closes: https://lore.kernel.org/lkml/0000000000003faaa105f6e7c658@google.com/T/ Signed-off-by: Christian A. Ehrhardt Reviewed-by: Christoph Hellwig --- block/blk-map.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/block/blk-map.c b/block/blk-map.c index 8584babf3ea0..71210cdb3442 100644 --- a/block/blk-map.c +++ b/block/blk-map.c @@ -205,12 +205,19 @@ static int bio_copy_user_iov(struct request *rq, struct rq_map_data *map_data, /* * success */ - if ((iov_iter_rw(iter) == WRITE && - (!map_data || !map_data->null_mapped)) || - (map_data && map_data->from_user)) { + if (iov_iter_rw(iter) == WRITE && + (!map_data || !map_data->null_mapped)) { ret = bio_copy_from_iter(bio, iter); if (ret) goto cleanup; + } else if (map_data && map_data->from_user) { + struct iov_iter iter2 = *iter; + + /* This is the copy-in part of SG_DXFER_TO_FROM_DEV. */ + iter2.data_source = ITER_SOURCE; + ret = bio_copy_from_iter(bio, &iter2); + if (ret) + goto cleanup; } else { if (bmd->is_our_pages) zero_fill_bio(bio);