Commit 52838787 authored by Pavel Begunkov's avatar Pavel Begunkov Committed by Jens Axboe
Browse files

io_uring/net: don't alias send user pointer reads 



We keep user pointers in an union, which could be a user buffer or a
user pointer to msghdr. What is confusing is that it potenitally reads
and assigns sqe->addr as one type but then uses it as another via the
union. Even more, it's not even consistent across copy and zerocopy
versions.

Make send and sendmsg setup helpers read sqe->addr and treat it as the
right type from the beginning. The end goal would be to get rid of
the use of struct io_sr_msg::umsg for send requests as we only need it
at the prep side.

Signed-off-by: default avatarPavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/685d788605f5d78af18802fcabf61ba65cfd8002.1729607201.git.asml.silence@gmail.com


Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent ad438d07

io_uring/net.c

+8 −5
Original line number Diff line number Diff line
@@ -363,6 +363,8 @@ static int io_send_setup(struct io_kiocb *req, const struct io_uring_sqe *sqe) 
	u16 addr_len;

	int ret;



	sr->buf = u64_to_user_ptr(READ_ONCE(sqe->addr));



	if (READ_ONCE(sqe->__pad3[0]))

		return -EINVAL;
@@ -390,11 +392,14 @@ static int io_send_setup(struct io_kiocb *req, const struct io_uring_sqe *sqe) 
	return 0;

}



static int io_sendmsg_setup(struct io_kiocb *req)

static int io_sendmsg_setup(struct io_kiocb *req, const struct io_uring_sqe *sqe)

{

	struct io_sr_msg *sr = io_kiocb_to_cmd(req, struct io_sr_msg);

	struct io_async_msghdr *kmsg = req->async_data;

	int ret;



	sr->umsg = u64_to_user_ptr(READ_ONCE(sqe->addr));



	ret = io_sendmsg_copy_hdr(req, kmsg);

	if (!ret)

		req->flags |= REQ_F_NEED_CLEANUP;
@@ -414,7 +419,6 @@ int io_sendmsg_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) 
			return -EINVAL;

	}



	sr->umsg = u64_to_user_ptr(READ_ONCE(sqe->addr));

	sr->len = READ_ONCE(sqe->len);

	sr->flags = READ_ONCE(sqe->ioprio);

	if (sr->flags & ~SENDMSG_FLAGS)
@@ -440,7 +444,7 @@ int io_sendmsg_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) 
		return -ENOMEM;

	if (req->opcode != IORING_OP_SENDMSG)

		return io_send_setup(req, sqe);

	return io_sendmsg_setup(req);

	return io_sendmsg_setup(req, sqe);

}



static void io_req_msg_cleanup(struct io_kiocb *req,
@@ -1262,7 +1266,6 @@ int io_send_zc_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) 
			return -EINVAL;

	}



	zc->buf = u64_to_user_ptr(READ_ONCE(sqe->addr));

	zc->len = READ_ONCE(sqe->len);

	zc->msg_flags = READ_ONCE(sqe->msg_flags) | MSG_NOSIGNAL | MSG_ZEROCOPY;

	zc->buf_index = READ_ONCE(sqe->buf_index);
@@ -1277,7 +1280,7 @@ int io_send_zc_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) 
		return -ENOMEM;

	if (req->opcode != IORING_OP_SENDMSG_ZC)

		return io_send_setup(req, sqe);

	return io_sendmsg_setup(req);

	return io_sendmsg_setup(req, sqe);

}



static int io_sg_from_iter_iovec(struct sk_buff *skb,