Re: [PATCH] io_uring/net: clear stale vec on buffer peek error after expansion

[Jens Axboe <axboe@kernel.dk>]

On 7/8/26 9:45 AM, Gabriel Krisman Bertazi wrote:
> Feng Xue <feng.xue@outlook.com> writes:
> 
>> Subject: [PATCH] io_uring/net: clear stale vec on buffer peek error after expansion
>>
>> When io_ring_buffers_peek() expands the iovec array during a bundle
>> recv retry, it frees the old array (A) and allocates a new one (B).
>> If access_ok() then fails, B is also freed and -EFAULT is returned.
>>
>> The callers io_recv_buf_select() and io_send_select_buffer() only
>> update kmsg->vec.iovec on success, so on this error path vec.iovec
>> still points to freed A. The stale pointer survives into the netmsg
>> alloc cache via io_netmsg_recycle() (vec.nr < IO_VEC_CACHE_SOFT_CAP
>> so io_vec_free is not called). A subsequent bundle operation reuses
>> the cached hdr, sees vec.iovec non-NULL, sets REQ_F_NEED_CLEANUP,
>> and passes the dangling pointer back to io_ring_buffers_peek() ?
>> which writes iovec entries to freed memory (use-after-free).
>>
>> If the alloc cache is full, the alternative cleanup path through
>> io_clean_op() ? io_vec_free() kfree()s the already-freed A
>> (double-free).
>>
>> Fix this by NULLing vec.iovec and zeroing vec.nr on the error path
>> when expansion occurred (detected by arg.iovs != kmsg->vec.iovec).
>> Do not call io_vec_free() here ? A is already freed by the expansion
>> block, so kfree()ing it again would itself be a double-free.
>>
>> Apply the same fix to io_send_select_buffer() which has the identical
>> update-after-success pattern.
> 
> cleaning in the caller makes the issue much more likely to happen again
> in a future use of this function.  It would be better to fix the bad
> semantics of io_ring_buffers_peek instead.
> 
> In fact, this is exactly the point of this patch, which I believe
> already fixed this issue:
> 
> https://lore.kernel.org/io-uring/178338543579.49877.9882374687710864124.b4-ty@b4/T/#t

Indeed, this version is just a terrible LLM version of trying to fix the
same thing, but not understanding the issue.

-- 
Jens Axboe