Commit a4c694bf authored by Joanne Koong's avatar Joanne Koong Committed by Jens Axboe
Browse files

io_uring/kbuf: use WRITE_ONCE() for userspace-shared buffer ring fields 



buf->addr and buf->len reside in memory shared with userspace. They
should be written with WRITE_ONCE() to guarantee atomic stores and
prevent tearing or other unsafe compiler optimizations.

Signed-off-by: default avatarJoanne Koong <joannelkoong@gmail.com>
Cc: Caleb Sander Mateos <csander@purestorage.com>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 78385c72

io_uring/kbuf.c

+4 −4
Original line number Diff line number Diff line
@@ -44,11 +44,11 @@ static bool io_kbuf_inc_commit(struct io_buffer_list *bl, int len) 
		buf_len -= this_len;

		/* Stop looping for invalid buffer length of 0 */

		if (buf_len || !this_len) {

			buf->addr = READ_ONCE(buf->addr) + this_len;

			buf->len = buf_len;

			WRITE_ONCE(buf->addr, READ_ONCE(buf->addr) + this_len);

			WRITE_ONCE(buf->len, buf_len);

			return false;

		}

		buf->len = 0;

		WRITE_ONCE(buf->len, 0);

		bl->head++;

		len -= this_len;

	}
@@ -291,7 +291,7 @@ static int io_ring_buffers_peek(struct io_kiocb *req, struct buf_sel_arg *arg, 
				arg->partial_map = 1;

				if (iov != arg->iovs)

					break;

				buf->len = len;

				WRITE_ONCE(buf->len, len);

			}

		}