io_uring: fix dead-hung for non-iter fixed rw

Browse source

Read/write requests to devices without implemented read/write_iter
using fixed buffers can cause general protection fault, which totally
hangs a machine.

io_import_fixed() initialises iov_iter with bvec, but loop_rw_iter()
accesses it as iovec, dereferencing random address.

kmap() page by page in this case

Cc: stable@vger.kernel.org
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

...

This commit is contained in:

Pavel Begunkov 2019-11-24 11:58:24 +03:00 • committed by Jens Axboe

parent f8e85cf255

commit 311ae9e159

1 changed files with 14 additions and 1 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

15

fs/io_uring.c

View file