scsi: bsg: read io_uring command fields once#900
Conversation
|
Upstream branch: e8c2f9f |
blktests-ci
Bot
force-pushed
the
linus-master_base
branch
from
86d8d37 to
9805659
Compare
|
Upstream branch: eb3f4b7 |
blktests-ci
Bot
force-pushed
the
series/1101822=>linus-master
branch
from
cb18062 to
9381633
Compare
blktests-ci
Bot
force-pushed
the
linus-master_base
branch
from
9805659 to
3f4a345
Compare
|
Upstream branch: 8fde5d1 |
blktests-ci
Bot
force-pushed
the
series/1101822=>linus-master
branch
from
9381633 to
8a30051
Compare
|
Upstream branch: 8fde5d1 |
blktests-ci
Bot
force-pushed
the
series/1101822=>linus-master
branch
from
8a30051 to
236abeb
Compare
blktests-ci
Bot
force-pushed
the
linus-master_base
branch
from
3f4a345 to
c6dc343
Compare
|
Upstream branch: e43ffb6 |
blktests-ci
Bot
force-pushed
the
series/1101822=>linus-master
branch
from
236abeb to
4b30617
Compare
blktests-ci
Bot
force-pushed
the
linus-master_base
branch
from
c6dc343 to
fc36596
Compare
|
Upstream branch: ba3e43a |
blktests-ci
Bot
force-pushed
the
series/1101822=>linus-master
branch
from
4b30617 to
61cd5e0
Compare
blktests-ci
Bot
force-pushed
the
linus-master_base
branch
from
fc36596 to
7bed9c3
Compare
|
Upstream branch: ddd664b |
blktests-ci
Bot
force-pushed
the
series/1101822=>linus-master
branch
from
61cd5e0 to
9af867b
Compare
blktests-ci
Bot
force-pushed
the
linus-master_base
branch
from
7bed9c3 to
a7bb5c5
Compare
|
Upstream branch: 979c294 |
blktests-ci
Bot
force-pushed
the
series/1101822=>linus-master
branch
from
9af867b to
b08b4e6
Compare
blktests-ci
Bot
force-pushed
the
linus-master_base
branch
from
a7bb5c5 to
5e41a3b
Compare
|
Upstream branch: acb7500 |
blktests-ci
Bot
force-pushed
the
series/1101822=>linus-master
branch
from
b08b4e6 to
c7513b5
Compare
blktests-ci
Bot
force-pushed
the
linus-master_base
branch
from
5e41a3b to
c3a084b
Compare
|
Upstream branch: 9716c08 |
blktests-ci
Bot
force-pushed
the
series/1101822=>linus-master
branch
from
c7513b5 to
c4d96e1
Compare
blktests-ci
Bot
force-pushed
the
linus-master_base
branch
from
c3a084b to
5f78e5d
Compare
|
Upstream branch: 2a2974b |
blktests-ci
Bot
force-pushed
the
series/1101822=>linus-master
branch
from
c4d96e1 to
7c223d8
Compare
blktests-ci
Bot
force-pushed
the
linus-master_base
branch
from
5f78e5d to
e48f9db
Compare
|
Upstream branch: 062871f |
blktests-ci
Bot
force-pushed
the
series/1101822=>linus-master
branch
from
7c223d8 to
02ce86f
Compare
blktests-ci
Bot
force-pushed
the
linus-master_base
branch
2 times, most recently
from
199644a to
e6d9eb8
Compare
|
Upstream branch: 66affa3 |
blktests-ci
Bot
force-pushed
the
series/1101822=>linus-master
branch
from
02ce86f to
5f93a24
Compare
blktests-ci
Bot
force-pushed
the
linus-master_base
branch
from
e6d9eb8 to
7d8604f
Compare
scsi_bsg_uring_cmd() reads struct bsg_uring_cmd fields directly from the shared mmap'd io_uring SQE. On the inline execution path, io_uring may still point at userspace-visible SQE storage, so a concurrent userspace thread can change fields between validation and use. request_len is checked against the size of scmd->cmnd, then used again for scmd->cmd_len and copy_from_user(). If userspace changes request_len after the bounds check, the later copy can overflow the 32-byte scmd->cmnd buffer. Transfer fields are also read again by scsi_bsg_map_user_buffer(), leaving direction, address and length open to the same race. Use READ_ONCE() to load each bsg_uring_cmd field needed by scsi_bsg_uring_cmd() into a local variable, then use those locals for both validation and execution. Pass the stable transfer direction, address and length into scsi_bsg_map_user_buffer() so the helper no longer re-derives them from the SQE. This fixes the double-fetch without copying the whole io_uring command payload. Tested with KASAN on QEMU (virtio-scsi, 2 vCPUs). Without this fix, a two-thread race produces: BUG: KASAN: wild-memory-access in scsi_queue_rq+0x4a3/0x58a0 Write of size 96 at addr dead000000001000 by task poc/67 Call Trace: kasan_report+0xce/0x100 __asan_memset+0x23/0x50 scsi_queue_rq+0x4a3/0x58a0 scsi_bsg_uring_cmd+0x942/0x1570 io_uring_cmd+0x2f6/0x950 io_issue_sqe+0xe5/0x22d0 Link: https://lore.kernel.org/all/20260527105931.3950913-1-rc@rexion.ai/T/#u Fixes: 7b6d325 ("scsi: bsg: add io_uring passthrough handler") Cc: stable@vger.kernel.org Signed-off-by: Rahul Chandelkar <rc@rexion.ai> Reviewed-by: Yang Xiuwei <yangxiuwei@kylinos.cn>
|
Upstream branch: bade58e |
blktests-ci
Bot
force-pushed
the
series/1101822=>linus-master
branch
from
5f93a24 to
e2e7041
Compare
Pull request for series with
subject: scsi: bsg: read io_uring command fields once
version: 2
url: https://patchwork.kernel.org/project/linux-block/list/?series=1101822