Merge patch series "fs: fixes for aio rings, backing files and iov_iter_alignment()"

Christian Brauner <brauner@kernel.org> says:

The aio bug fixed here is the third way this year to fault on an aio
ring after its file was truncated. The ring file has no ->read_folio
because all of its folios are supposed to be in the page cache so we
jump to NULL. This time vm_munmap() gets interrupted by a fatal signal
in io_destroy() and leaves the ring mapped. I didn't want to plug yet
another route so the ring now gets a ->read_folio that fails and the
fault gets SIGBUS. Making the munmap unkillable would only cover this
one route.

I rewrote the backing-file one. FUSE passthrough opens the backing file
with the flags of the user's open but never runs the may_open() checks
against the backing inode. So a passthrough file backed by an
append-only file can be overwritten anywhere and one backed by an
immutable file can be written to. Chris' version only checked the write
paths. That left shared mappings and S_IMMUTABLE open and it failed
writes on file descriptors opened before chattr +a which can keep
writing on any other filesystem. So the checks are now done at open and
mmap time like may_open() and do_mmap() do and writes only fail if
append mode was taken away from the user file.

FUSE reports EIO instead of EPERM for a refused open because it turns
every error from opening the backing file into EIO. I left that alone.
Miklos, if you'd rather pass the error through I can do that on top.
Amir, for overlayfs this only changes something if the upper inode is
changed behind its back.

The iov_iter one is a NULL deref that any user can trigger on btrfs with
a single zero-length IORING_OP_READ_FIXED on an O_DIRECT file.
io_import_fixed() hands out an empty bvec iterator without an array for
that and iov_iter_alignment() looks at the first segment before it
checks the count. Other places build such iterators as well so I fixed
iov_iter_alignment() instead of io_uring.

All three are tested in a KASAN VM. Without the patches the aio and
iov_iter reproducers oops and the backing-file one overwrites both an
append-only and an immutable file through FUSE passthrough. With them
none of that happens.

* patches from https://patch.msgid.link/20261029-work-fs-ai-fixes-v1-0-88f22792f6f7@kernel.org:
  iov_iter: fix NULL deref in iov_iter_alignment()
  backing-file: enforce append-only and immutable backing inodes
  aio: fix NULL deref when a fault races ring truncation

Link: https://patch.msgid.link/20261029-work-fs-ai-fixes-v1-0-88f22792f6f7@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

0 files changed, 0 insertions, 0 deletions