From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pf1-f178.google.com (mail-pf1-f178.google.com [209.85.210.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 09F34438482 for ; Mon, 6 Jul 2026 18:26:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.178 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783362362; cv=none; b=c3oInggxh1eDfWGPyBQXkJCbnDtxiSRqQk7+og664lLH/Jf4YdYLW1bKwdihdJxi9g13/7PVVFbf3QpkEKs0eNs1HEOnQECe23VfpIBf/0jKFdSmLC1DmWaE/2aMQTbnhCwmaisueYXiDW/9W2n2CCVJH+12uswtoxZtY0aE2yI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783362362; c=relaxed/simple; bh=q3Biw9dVViTriSRGhp9mOH4a90WIr48NK6MQu3wHl5A=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=sMKSvzYgg2/0t3/P2YJ+6eDPYimOpLLUFWsuNpIhsd8FDgNIfAkyqWMZJXg5Crx774HxHpoEApbQnAXNeBNILgfggY6Ge+7GOQxp1Xlx5/eLPZBEbiZJx34CdI5fQTFe0gAYUFucRHoqzWhd9Af/S0043hjxdXjClDjBitAgV+0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=OKQcd976; arc=none smtp.client-ip=209.85.210.178 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="OKQcd976" Received: by mail-pf1-f178.google.com with SMTP id d2e1a72fcca58-847a483e344so135767b3a.0 for ; Mon, 06 Jul 2026 11:26:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783362360; x=1783967160; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=EhzAaTVsqENZ7jpjX8qsNEQ/QhOMPWhppRHzOqJiw64=; b=OKQcd976Hxib3sHG5ms8b122F9DSFjn4+3vwMwWVbAq2dDYuiWrZROeikvOXoV5lfj uJQCV13DjZluttD+JMZFkqdCmwDn73uvzTPwHbr2FFdj9wowLYJcQlaoXZQ+sEsH5aqJ hUgCu1OBwkKnMPoLAp6i9WoSIt2y7Ih27fB6P/m2Kwg+79kK3wdxjx79TsiVBR9xMzeY vjeeSl+HnY0SA9hHL7NyeAQfSXZktox+KHzSgghLDAzT6AbYJ75aGMSkoVYlHpRIXpWx AOb+vwdrTgXGghTbTEQiOrATB1ci9nMm2p8wkxcqiJr/ETBZVKUUZ1nR6K1j6AuAsiuy HeYA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783362360; x=1783967160; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=EhzAaTVsqENZ7jpjX8qsNEQ/QhOMPWhppRHzOqJiw64=; b=lVQwDyqGzujoKzGXFeoziFX3sc53dwgFMGRI9T2huASwFSogh/yIeTxtGHnSl5D9ic eXTYn+QkT5dE+U+B/tyKynOpuTma3feuuazI4soznoTNIjGouXOYc3iajq1y0ATGlIEe OFqVvh94obq/7sxjJ6bQfP0hEmaezT7vRoeSINkobs9EJsX79RFJxdThhAqiOHiR+7IO 66T4Ti/7xGn4DtL4ggV07zXKDrjojevRNZDoqJ9blG425KURiOQwWIJCjFP1yQo6sd5t geaXsa6OtjZ0S70FTk6ZGvMKOHCyJ23SVDx3izyGpXWD2pwZ/H7ge9l76EtwHd7peqrQ crxQ== X-Gm-Message-State: AOJu0Yxd07u/DxyWNutAn6TKOMmD8sD7m+PS6CtZG3mYeKyBsXG28QTr 1HBX3xNL049/Ux+zeJWhl7Eoxolq9KbjBoBhLLevjO8N3rHSAJHW1laDmgrO8PNK4Ns= X-Gm-Gg: AfdE7cl8gshhzjcypSOqMGJk7UP8x6u0yoWgtDkv6pRpdhhdgXFpL63M5CDChtHTjLd GbpAyfuB+cHgNMQDOkKFlcw+b0PC80pGp/QG/mAKG+rJS/MPvS7IEmZYF98oA+lhjHCmTbvHOa9 foZkWYBccsO31KlOEkChkFSqMGvXy024NW6F9+ln2CJUY6M36veeX+P/KlDLN88KvR11tjSJlmc /nNY95GaaXXW5QTSd2OBpMU7Qx8RieYOjRckvCuCvPfKk4Y0sD4U3asuLhvJQ+IeTjhv+nauMmD pg1Mt4PD4e3XMufEgHnM3sm2m60jlDdUkjtB3Y33rNeb9RnKTNPrz3PxhDMaPXiNe/bxih1gF9o KoTQ+KmNkCiu7nzlgxpYgqAMnWbigmmrmpCp5QFSamLObMx4yZ5RiYlLz2nuUk8qK1mMa2i8sMU cyGNeBrSfENrUTu0HmuWziu8xnf68OMBo9NdCS9MquwKW49pTpexCbio0= X-Received: by 2002:a05:6a00:399f:b0:846:eaac:a5ea with SMTP id d2e1a72fcca58-84825f0636cmr1671705b3a.3.1783362360139; Mon, 06 Jul 2026 11:26:00 -0700 (PDT) Received: from naup-virtual-machine.localdomain ([140.113.139.102]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-847f6bc9f5dsm4228958b3a.27.2026.07.06.11.25.58 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 06 Jul 2026 11:25:59 -0700 (PDT) From: Hao-Yu Yang To: linux-kernel@vger.kernel.org Cc: axboe@kernel.dk, io-uring@vger.kernel.org, Hao-Yu Yang Subject: [PATCH v2] From b1014148d31468e2dcd8f237740ca1643571e875 Mon Sep 17 00:00:00 2001 From: Hao-Yu Yang Date: Sun, 5 Jul 2026 11:43:02 +0800 Subject: [PATCH v1] io_uring: fix dangling iovec after provided-buffer bundle grow failure Date: Tue, 7 Jul 2026 02:25:34 +0800 Message-Id: <20260706182534.918737-1-naup96721@gmail.com> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit When growing a provided-buffer bundle, the old cached iovec is freed before the new buffers have all been validated. If validation fails, the request still points at the freed iovec, which can be freed again during completion cleanup. BUG: KASAN: double-free in io_vec_free+0x2c/0x90 Freed by task 73: kfree+0x104/0x3b0 io_vec_free+0x2c/0x90 __io_submit_flush_completions+0xc03/0x1e40 io_submit_sqes+0xdb5/0x2310 Allocated by task 73: io_ring_buffers_peek+0x559/0xc60 io_buffers_select+0x1c1/0x460 io_send+0x770/0x1050 Fix this by deferring the free of the old cached iovec until validation has succeeded. On failure, free the newly allocated iovec and leave the request pointing at the original one. change log: v2: slimming v1 patch Fixes: 46800585ae04 ("io_uring/kbuf: validate ring provided buffer addresses with access_ok()") Signed-off-by: Hao-Yu Yang --- io_uring/kbuf.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c index 3cd29477fff2..b6b969b55e12 100644 --- a/io_uring/kbuf.c +++ b/io_uring/kbuf.c @@ -287,8 +287,6 @@ static int io_ring_buffers_peek(struct io_kiocb *req, struct buf_sel_arg *arg, iov = kmalloc_objs(struct iovec, nr_avail); if (unlikely(!iov)) return -ENOMEM; - if (arg->mode & KBUF_MODE_FREE) - kfree(arg->iovs); arg->iovs = iov; nr_iovs = nr_avail; } else if (nr_avail < nr_iovs) { @@ -330,6 +328,9 @@ static int io_ring_buffers_peek(struct io_kiocb *req, struct buf_sel_arg *arg, buf = io_ring_head_to_buf(br, ++head, bl->mask); } while (--nr_iovs); + if (arg->mode & KBUF_MODE_FREE) + kfree(arg->iovs); + if (head == tail) req->flags |= REQ_F_BL_EMPTY; -- 2.34.1