[PATCH] io_uring: zero remained bytes when reading to fixed kernel buffer

[Ming Lei <ming.lei@xxxxxxxxxx>]

So far fixed kernel buffer is only used for FS read/write, in which
the remained bytes need to be zeroed in case of short read, otherwise
kernel data may be leaked to userspace.

Add two helpers for fixing this issue, meantime replace one check
with io_use_fixed_kbuf().

Cc: Caleb Sander Mateos <csander@xxxxxxxxxxxxxxx>
Cc: Keith Busch <kbusch@xxxxxxxxxx>
Fixes: 27cb27b6d5ea ("io_uring: add support for kernel registered bvecs")
Signed-off-by: Ming Lei <ming.lei@xxxxxxxxxx>
---
 io_uring/rsrc.h | 16 ++++++++++++++++
 io_uring/rw.c   |  8 +++++++-
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/io_uring/rsrc.h b/io_uring/rsrc.h
index b52242852ff3..6996eb8e5b7d 100644
--- a/io_uring/rsrc.h
+++ b/io_uring/rsrc.h
@@ -169,4 +169,20 @@ static inline void io_alloc_cache_vec_kasan(struct iou_vec *iv)
 		io_vec_free(iv);
 }
 
+/* do not call it before assigning buffer node to request */
+static inline bool io_use_fixed_kbuf(struct io_kiocb *req)
+{
+	return (req->flags & REQ_F_BUF_NODE) && req->buf_node->buf->is_kbuf;
+}
+
+/* zero remained bytes of kernel buffer for avoiding to leak data */
+static inline void io_req_zero_remained(struct io_kiocb *req,
+					struct iov_iter *iter)
+{
+	size_t left = iov_iter_count(iter);
+
+	if (left > 0 && iov_iter_rw(iter) == READ)
+		iov_iter_zero(left, iter);
+}
+
 #endif
diff --git a/io_uring/rw.c b/io_uring/rw.c
index 039e063f7091..67dc1a6710c9 100644
--- a/io_uring/rw.c
+++ b/io_uring/rw.c
@@ -541,6 +541,12 @@ static void __io_complete_rw_common(struct io_kiocb *req, long res)
 	} else {
 		req_set_fail(req);
 		req->cqe.res = res;
+
+		if (io_use_fixed_kbuf(req)) {
+			struct io_async_rw *io = req->async_data;
+
+			io_req_zero_remained(req, &io->iter);
+		}
 	}
 }
 
@@ -692,7 +698,7 @@ static ssize_t loop_rw_iter(int ddir, struct io_rw *rw, struct iov_iter *iter)
 	if ((kiocb->ki_flags & IOCB_NOWAIT) &&
 	    !(kiocb->ki_filp->f_flags & O_NONBLOCK))
 		return -EAGAIN;
-	if ((req->flags & REQ_F_BUF_NODE) && req->buf_node->buf->is_kbuf)
+	if (io_use_fixed_kbuf(req))
 		return -EFAULT;
 
 	ppos = io_kiocb_ppos(kiocb);
-- 
2.47.1