[PATCH v2] io_uring/rsrc: fix slab-out-of-bounds in io_buffer_register_bvec

[veygax <veyga@veygax.dev>]

From: Evan Lambert <veyga@veygax.dev>

The function io_buffer_register_bvec() calculates the allocation size
for the io_mapped_ubuf based on blk_rq_nr_phys_segments(rq). This
function calculates the number of scatter-gather elements after merging
physically contiguous pages.

However, the subsequent loop uses rq_for_each_bvec() to populate the
array, which iterates over every individual bio_vec in the request,
regardless of physical contiguity.

If a request has multiple bio_vec entries that are physically
contiguous, blk_rq_nr_phys_segments() returns a value smaller than
the total number of bio_vecs. This leads to a slab-out-of-bounds write.

The path is reachable from userspace via the ublk driver when a server
issues a UBLK_IO_REGISTER_IO_BUF command. This requires the
UBLK_F_SUPPORT_ZERO_COPY flag which is protected by CAP_SYS_ADMIN.

Fix this by checking if the current bio_vec is physically contiguous
with the previous one. If they are contiguous, it extends the length of
the existing entry instead of writing a new one, ensuring the population
loop mirrors the segment merging done during allocation.

KASAN report:

BUG: KASAN: slab-out-of-bounds in io_buffer_register_bvec+0x813/0xb80
Write of size 8 at addr ffff88800223b238 by task kunit_try_catch/27
[...]
Call Trace:
 <TASK>
 dump_stack_lvl+0x4d/0x70
 print_report+0x151/0x4c0
 ? __pfx__raw_spin_lock_irqsave+0x10/0x10
 ? io_buffer_register_bvec+0x813/0xb80
 kasan_report+0xec/0x120
 ? io_buffer_register_bvec+0x813/0xb80
 io_buffer_register_bvec+0x813/0xb80
 io_buffer_register_bvec_overflow_test+0x4e6/0x9b0
 ? __pfx_io_buffer_register_bvec_overflow_test+0x10/0x10
 ? __pfx_pick_next_task_fair+0x10/0x10
 ? _raw_spin_lock+0x7e/0xd0
 ? finish_task_switch.isra.0+0x19a/0x650
 ? __pfx_read_tsc+0x10/0x10
 ? ktime_get_ts64+0x79/0x240
 kunit_try_run_case+0x19b/0x2c0
 ? __pfx_kunit_try_run_case+0x10/0x10
 ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
 kunit_generic_run_threadfn_adapter+0x80/0xf0
 kthread+0x323/0x670
 ? __pfx_kthread+0x10/0x10
 ? __pfx__raw_spin_lock_irq+0x10/0x10
 ? __pfx_kthread+0x10/0x10
 ret_from_fork+0x329/0x420
 ? __pfx_ret_from_fork+0x10/0x10
 ? __switch_to+0xa0f/0xd40
 ? __pfx_kthread+0x10/0x10
 ret_from_fork_asm+0x1a/0x30
 </TASK>

Fixes: 27cb27b6d5ea ("io_uring: add support for kernel registered bvecs")
Signed-off-by: Evan Lambert <veyga@veygax.dev>
---
Fixed the typos helpfully spotted by Caleb + added a new approach where
we check if the current bio_vec is physically contiguous with the
previous one. This stops the OOB write from occuring via my KUnit test.

 io_uring/rsrc.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c
index a63474b331bf..16259b75f363 100644
--- a/io_uring/rsrc.c
+++ b/io_uring/rsrc.c
@@ -988,8 +988,20 @@ int io_buffer_register_bvec(struct io_uring_cmd *cmd, struct request *rq,
 	imu->is_kbuf = true;
 	imu->dir = 1 << rq_data_dir(rq);
 
-	rq_for_each_bvec(bv, rq, rq_iter)
+	nr_bvecs = 0;
+	rq_for_each_bvec(bv, rq, rq_iter) {
+		if (nr_bvecs > 0) {
+			struct bio_vec *p = &imu->bvec[nr_bvecs - 1];
+
+			if (page_to_phys(p->bv_page) + p->bv_offset + p->bv_len ==
+			    page_to_phys(bv.bv_page) + bv.bv_offset &&
+			    p->bv_len + bv.bv_len >= p->bv_len) {
+				p->bv_len += bv.bv_len;
+				continue;
+			}
+		}
 		imu->bvec[nr_bvecs++] = bv;
+	}
 	imu->nr_bvecs = nr_bvecs;
 
 	node->buf = imu;
-- 
2.52.0