io_uring: Add missing include for ITER_SOURCE and ITER_DEST - #117
Open
blktests-ci-block-trial[bot] wants to merge 2 commits into
Open
io_uring: Add missing include for ITER_SOURCE and ITER_DEST#117blktests-ci-block-trial[bot] wants to merge 2 commits into
blktests-ci-block-trial[bot] wants to merge 2 commits into
Conversation
Author
|
Upstream branch: 0f23d56 |
blktests-ci-block-trial
Bot
force-pushed
the
master_base
branch
from
August 18, 2026 21:37
f44f344 to
9bee990
Compare
Author
|
Upstream branch: 1200d84 |
blktests-ci-block-trial
Bot
force-pushed
the
series/659=>master
branch
from
August 18, 2026 21:59
aec74d2 to
a7eadfa
Compare
blktests-ci-block-trial
Bot
force-pushed
the
master_base
branch
from
August 19, 2026 00:06
9bee990 to
87a06b3
Compare
Author
|
Upstream branch: 3a0dd7b |
blktests-ci-block-trial
Bot
force-pushed
the
series/659=>master
branch
from
August 19, 2026 00:24
a7eadfa to
59439e6
Compare
blktests-ci-block-trial
Bot
force-pushed
the
master_base
branch
from
August 19, 2026 02:15
87a06b3 to
f2b91d1
Compare
Author
|
Upstream branch: b126f6f |
blktests-ci-block-trial
Bot
force-pushed
the
series/659=>master
branch
from
August 19, 2026 02:37
59439e6 to
fbf8a21
Compare
blktests-ci-block-trial
Bot
force-pushed
the
master_base
branch
from
August 19, 2026 04:26
f2b91d1 to
da1ee34
Compare
Author
|
Upstream branch: bd5f485 |
blktests-ci-block-trial
Bot
force-pushed
the
series/659=>master
branch
from
August 19, 2026 04:46
fbf8a21 to
3a2e0b0
Compare
blktests-ci-block-trial
Bot
force-pushed
the
master_base
branch
from
August 19, 2026 18:41
da1ee34 to
45acce2
Compare
Author
|
Upstream branch: 59e6295 |
blktests-ci-block-trial
Bot
force-pushed
the
series/659=>master
branch
from
August 19, 2026 18:54
3a2e0b0 to
4b33265
Compare
blktests-ci-block-trial
Bot
force-pushed
the
master_base
branch
from
August 19, 2026 20:56
45acce2 to
c54091c
Compare
Author
|
Upstream branch: 98f21c5 |
blktests-ci-block-trial
Bot
force-pushed
the
series/659=>master
branch
from
August 19, 2026 21:16
4b33265 to
defde41
Compare
blktests-ci-block-trial
Bot
force-pushed
the
master_base
branch
from
August 19, 2026 23:06
c54091c to
f28d8dc
Compare
Author
|
Upstream branch: cb8a75e |
blktests-ci-block-trial
Bot
force-pushed
the
series/659=>master
branch
from
August 19, 2026 23:28
defde41 to
8889623
Compare
blktests-ci-block-trial
Bot
force-pushed
the
master_base
branch
from
August 20, 2026 01:25
f28d8dc to
3705daf
Compare
Author
|
Upstream branch: a4ff2be |
blktests-ci-block-trial
Bot
force-pushed
the
series/659=>master
branch
from
August 20, 2026 01:46
8889623 to
259114f
Compare
blktests-ci-block-trial
Bot
force-pushed
the
master_base
branch
from
August 20, 2026 18:14
3705daf to
98a2d8e
Compare
Author
|
Upstream branch: 9d2ed02 |
blktests-ci-block-trial
Bot
force-pushed
the
series/659=>master
branch
from
August 20, 2026 18:30
259114f to
60bf020
Compare
blktests-ci-block-trial
Bot
force-pushed
the
master_base
branch
from
August 20, 2026 20:59
98a2d8e to
96fc384
Compare
Fix IWYU issues:
/tmp/next/build/include/linux/io_uring_types.h:56:32: error: 'ITER_DEST'
undeclared here (not in a function)
56 | IO_BUF_DEST = 1 << ITER_DEST,
| ^~~~~~~~~
/tmp/next/build/include/linux/io_uring_types.h:57:32: error: 'ITER_SOURCE'
undeclared here (not in a function)
57 | IO_BUF_SOURCE = 1 << ITER_SOURCE,
| ^~~~~~~~~~~
Fixes: 95961b72c57b2 ("io_uring/rsrc: rename and export IO_IMU_DEST / IO_IMU_SOURCE")
Signed-off-by: Mark Brown <broonie@kernel.org>
Author
|
Upstream branch: c84d3e3 |
blktests-ci-block-trial
Bot
force-pushed
the
series/659=>master
branch
from
August 20, 2026 21:21
60bf020 to
c9f6dc9
Compare
blktests-ci-block-trial
Bot
force-pushed
the
master_base
branch
5 times, most recently
from
August 23, 2026 07:06
787bdf5 to
e0cf505
Compare
blktests-ci-block-trial Bot
pushed a commit
that referenced
this pull request
Aug 23, 2026
ipc_validate_msg() computes the expected message size by reading length fields out of the response buffer supplied by the userspace ksmbd daemon (payload_sz, session_key_len, ngroups, ...). Those fields are read before the buffer is verified to be large enough to contain the struct they belong to, so a short response makes the read land past the end of the allocation. handle_response() sizes entry->response purely from the netlink attribute length (nla_len()) and only guards the leading handle read, so the daemon can install a response as small as the kmalloc-8 object seen below. When ipc_msg_send_request() then calls ipc_validate_msg() for a KSMBD_EVENT_RPC_REQUEST, the cast to struct ksmbd_rpc_command reads resp->payload_sz at offset 8 of an 8-byte allocation: [ 3697.841381] ================================================================== [ 3697.844099] BUG: KASAN: slab-out-of-bounds in ipc_msg_send_request+0x763/0x800 [ 3697.846604] Read of size 4 at addr ffff888105f95910 by task kworker/4:3/20682 [ 3697.849061] [ 3697.849801] CPU: 4 UID: 0 PID: 20682 Comm: kworker/4:3 Not tainted 7.2.0-rc3-next-20260717-virtme #117 PREEMPT(lazy) [ 3697.850077] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014 [ 3697.850303] Workqueue: ksmbd-io handle_ksmbd_work [ 3697.850592] Call Trace: [ 3697.850794] <TASK> [ 3697.850952] __dump_stack+0x21/0x60 [ 3697.851239] dump_stack_lvl+0xc2/0x100 [ 3697.851528] print_address_description+0x77/0x200 [ 3697.851816] ? ipc_msg_send_request+0x763/0x800 [ 3697.852024] print_report+0x58/0x70 [ 3697.852316] kasan_report+0x117/0x150 [ 3697.852585] ? down_write+0x146/0x1f0 [ 3697.852809] ? ipc_msg_send_request+0x763/0x800 [ 3697.853082] ipc_msg_send_request+0x763/0x800 [ 3697.853385] ? __pfx_ipc_msg_send_request+0x10/0x10 [ 3697.853604] ? kasan_unpoison+0x48/0x70 [ 3697.853936] ? __pfx___up_read+0x10/0x10 [ 3697.854221] ksmbd_rpc_ioctl+0x380/0x520 [ 3697.854542] ? __pfx_ksmbd_rpc_ioctl+0x10/0x10 [ 3697.854757] ? kasan_unpoison+0x48/0x70 [ 3697.854962] ? copy_from_kernel_nofault+0x32c/0x4e0 [ 3697.855166] ? kasan_unpoison+0x48/0x70 [ 3697.855416] fsctl_pipe_transceive+0x139/0x7a0 [ 3697.855705] ? __pfx_copy_from_kernel_nofault+0x10/0x10 [ 3697.855937] ? __pfx_fsctl_pipe_transceive+0x10/0x10 [ 3697.856388] ? __sanitizer_cov_trace_switch+0x7b/0x140 [ 3697.856620] smb2_ioctl+0x1141/0x3420 [ 3697.856994] ? __pfx_smb2_ioctl+0x10/0x10 [ 3697.857182] ? get_smb2_cmd_val+0xe3/0x1c0 [ 3697.857655] handle_ksmbd_work+0x9ad/0x15e0 [ 3697.858034] ? __pfx_handle_ksmbd_work+0x10/0x10 [ 3697.858251] ? lock_release+0xf7/0x360 [ 3697.858466] ? process_scheduled_works+0x954/0x1600 [ 3697.858698] ? process_scheduled_works+0x954/0x1600 [ 3697.858905] process_scheduled_works+0xc22/0x1600 [ 3697.859368] ? __pfx_process_scheduled_works+0x10/0x10 [ 3697.859637] ? __pfx_assign_work+0x10/0x10 [ 3697.859896] ? lock_is_held_type+0x7b/0x110 [ 3697.860146] worker_thread+0x975/0xee0 [ 3697.860524] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 3697.860830] ? __kthread_parkme+0x21e/0x260 [ 3697.861105] kthread+0x3a6/0x490 [ 3697.861423] ? __pfx_worker_thread+0x10/0x10 [ 3697.861643] ? __pfx_kthread+0x10/0x10 [ 3697.861878] ret_from_fork+0x55a/0xa20 [ 3697.862194] ? __pfx_ret_from_fork+0x10/0x10 [ 3697.862480] ? __pfx_kthread+0x10/0x10 [ 3697.862714] ret_from_fork_asm+0x1a/0x30 [ 3697.862965] </TASK> [ 3697.863039] [ 3697.938882] Allocated by task 20761: [ 3697.940257] kasan_save_track+0x3e/0x80 [ 3697.941782] __kasan_kmalloc+0x72/0x90 [ 3697.943228] __kvmalloc_node_noprof+0x3e9/0x6a0 [ 3697.944948] handle_generic_event+0x59b/0x750 [ 3697.946592] genl_family_rcv_msg_doit+0x3d6/0x560 [ 3697.946977] genl_rcv_msg+0x67c/0x900 [ 3697.947224] netlink_rcv_skb+0x286/0x580 [ 3697.947488] genl_rcv+0x2d/0x80 [ 3697.947706] netlink_unicast+0x937/0xb70 [ 3697.947993] netlink_sendmsg+0x977/0xc10 [ 3697.948268] __sock_sendmsg+0x264/0x2d0 [ 3697.948536] __sys_sendto+0x4de/0x690 [ 3697.948789] __x64_sys_sendto+0x173/0x380 [ 3697.949069] do_syscall_64+0x13d/0x420 [ 3697.949328] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 3697.949662] [ 3697.949779] The buggy address belongs to the object at ffff888105f95908 [ 3697.949779] which belongs to the cache kmalloc-8 of size 8 [ 3697.950550] The buggy address is located 0 bytes to the right of [ 3697.950550] allocated 8-byte region [ffff888105f95908, ffff888105f95910) [ 3697.951455] [ 3697.951574] The buggy address belongs to the physical page: [ 3697.951958] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888105f951b8 pfn:0x105f95 [ 3697.952571] flags: 0x100000000000200(workingset|node=0|zone=2) [ 3697.952973] page_type: f5(slab) [ 3697.953198] raw: 0100000000000200 ffff888100042640 ffffea0004063610 ffff888100040588 [ 3697.953707] raw: ffff888105f951b8 00000000001c000e 00000000f5000000 0000000000000000 [ 3697.954240] page dumped because: kasan: bad access detected [ 3697.954616] [ 3697.954734] Memory state around the buggy address: [ 3697.955063] ffff888105f95800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fa [ 3697.955534] ffff888105f95880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3697.956006] >ffff888105f95900: fc 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3697.956477] ^ [ 3697.956728] ffff888105f95980: fc fc fc fa fc fc fc fc fc fc fc fc fc fc fc fc [ 3697.957202] ffff888105f95a00: fc fc fc fc fc fa fc fc fc fc fc fc fc fc fc fc [ 3697.957671] ================================================================== The final "entry->msg_sz != msg_sz" comparison cannot help: the offending read has already happened by the time it runs. Every case in the switch shares this pattern. Floor entry->msg_sz against the base struct of each event type before dereferencing any of its length fields. On failure ipc_msg_send_request() already frees the response and returns NULL, so callers stay safe. The malformed message originates from the ksmbd.mountd daemon over genl netlink rather than a remote SMB client, so triggering it requires a buggy or compromised daemon; it is still an out-of-bounds read the validator is meant to prevent. Fixes: d6a6aa8 ("ksmbd: validate response sizes in ipc_validate_msg()") Signed-off-by: Yunseong Kim <yunseong.kim@est.tech> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
blktests-ci-block-trial
Bot
force-pushed
the
master_base
branch
4 times, most recently
from
August 24, 2026 02:38
234c2d8 to
7759c50
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pull request for series with
subject: io_uring: Add missing include for ITER_SOURCE and ITER_DEST
version: 1
url: http://redsun45:8000/project/linux-block/list/?series=659