From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f177.google.com (mail-pl1-f177.google.com [209.85.214.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CEFA13B14A5 for ; Mon, 6 Jul 2026 18:33:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.177 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783362798; cv=none; b=KdFhFbxLMIUpJmq9c7FzKVzd8DRBgp6vDqdlJHW+mSWCRxcW9FvYzxUKrkp/uMYvgzIFQJbiDaCHw1cCV4eH35JvzrzhPcoWhRtNxG5eYP1Sza5i4CXb2/rQUQirNaRxDsIVuEMItlR6y/OmYlXfMWV64YRh5McCrLCBCvAkH04= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783362798; c=relaxed/simple; bh=q3Biw9dVViTriSRGhp9mOH4a90WIr48NK6MQu3wHl5A=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=GhQXGbSmd9RWbYiOfjxzn2N7i/OhJBPNEVPchScUJN0Tuto22SoY9J+X5uGzQ8JOja6NFeusra/+DCk/os+EtriPlqiXFbE5MchPnyMc4FhNlMnqUauqz9Rrd2fNUn3P0T9kmjGGLmuKS95rUAJNIUNLJw0LYkji7mh896dvThU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=cVDysh2h; arc=none smtp.client-ip=209.85.214.177 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="cVDysh2h" Received: by mail-pl1-f177.google.com with SMTP id d9443c01a7336-2cca24023edso17989565ad.1 for ; Mon, 06 Jul 2026 11:33:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783362796; x=1783967596; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=EhzAaTVsqENZ7jpjX8qsNEQ/QhOMPWhppRHzOqJiw64=; b=cVDysh2hhOMnR157X/JsBgWaZSQAm+aTsW+9GYH5QQgsY+u3ESwRw5PRfOk13BO5n8 RRA1JdYo4cKkQVJAoWYnGZk6yvioRq98/zQ0+o+JpxPgX/3Ga8lnDT/ZOFLthg0HUF/J 4vgA0q4cHXWHCptvGt9RT6eI2VPyYgstJSwQ5SYDmch1Mip9GPnHOupSsoPWd4o6XYX0 jBmprwSYUbQQ2ISpAsQ+Zf0kzbFhlLDIKtlwJSAq5zJVx7E1DWGr1+1xu4Fcavzr6c3r ltilmPh0Gf6KuytG2OEpW34S86jUrVc2V1owQLTXvG+B7ni35cjldELxAL3uj89hFK+n ie7g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783362796; x=1783967596; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=EhzAaTVsqENZ7jpjX8qsNEQ/QhOMPWhppRHzOqJiw64=; b=VsHwjhXprYEd8OSmDKFALhMEdiC53lJBX0GlO51vJV75fSxFQCw4aD+hwLcax4dx3A js9h2nD+n97/RRuKFGGiOW9ytMVZlcVEkj7caoekA+qfSM1c7DzhT7StbvcQcfdHC/EZ R+ddeQ+cRtgkxUrlTW8CCQD1aYWommRI9igJqinon6vc4SaLIMKEoh+TqeooFSTpi7xh zR9cI0Kcqn1qB6pfPijGSVPA26pr2R7/OuutI9tOtL96xlBM1ZYvmPUDtxNmZWx6NlnE XBMU+y98G25Y6AKDqOs4fir+3frW0QHnSrDN6oAoDcXYcW09s8nLgqBu78eMF9HgmiCL GPwA== X-Gm-Message-State: AOJu0YzT5zUKLxy3cxKFlWS00pVEL1offqchrIMjpyvnzl3KANVFBGX8 RvlCIVT/kBg2qzdofAB/KBzqxBrNjjcdTKp0UD31DHDFcWzbqz7guWeJVzVHqXMjWKE= X-Gm-Gg: AfdE7ckVvMlOSpl1YXPaTvPYo8UB/7vv+6LZNyBXU28t34ojg+QeBoj0R0DUVAZSRN7 a5N/XLZ19ZOf8qfDCDVfxOkye4pHJ32tWZxVN3J2CyFXDvKY1pudQXlUVhka4tD/dDT9gYEH6KX oL0O1BKNN6zirKXYAryilKMYsKZAlixEbMXbLnz6rrJhb/zWuKZMHQXL9yVZDA4iNKZG1JsGCJY sdRkIGGui95fOAF0sevcxIAdxVeQbBYC30mIjoSQgabe0/8GPezH319T48lirE28xwEo09lokTJ 2sblMv02jF1mNgUL/DWx8yjJj1wwZFDsBjzvpeChhCTs4yEMDNRSbGH0DT7wG0aWnVzCIbRon2a +Q4GY4++I+bXgLRElQrbYIT4TobgRV6WWxuRamfHrCouMJq6nAgKSvm/f/G8wTg8DP6ixacXL4s PaxrH9ZtZ5R6WzKjq2iUElA/ZmhVzUSESfvC4Xuoko9xlOftWjyHVF7a0= X-Received: by 2002:a17:903:3845:b0:2ca:ed41:d337 with SMTP id d9443c01a7336-2ccbf189068mr20617915ad.43.1783362796043; Mon, 06 Jul 2026 11:33:16 -0700 (PDT) Received: from naup-virtual-machine.localdomain ([140.113.139.102]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2cad7894b06sm55235405ad.77.2026.07.06.11.33.14 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 06 Jul 2026 11:33:15 -0700 (PDT) From: Hao-Yu Yang To: linux-kernel@vger.kernel.org Cc: axboe@kernel.dk, io-uring@vger.kernel.org, Hao-Yu Yang Subject: [PATCH v2] io_uring: fix dangling iovec after provided-buffer bundle grow failure Date: Tue, 7 Jul 2026 02:33:04 +0800 Message-Id: <20260706183304.919275-1-naup96721@gmail.com> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit When growing a provided-buffer bundle, the old cached iovec is freed before the new buffers have all been validated. If validation fails, the request still points at the freed iovec, which can be freed again during completion cleanup. BUG: KASAN: double-free in io_vec_free+0x2c/0x90 Freed by task 73: kfree+0x104/0x3b0 io_vec_free+0x2c/0x90 __io_submit_flush_completions+0xc03/0x1e40 io_submit_sqes+0xdb5/0x2310 Allocated by task 73: io_ring_buffers_peek+0x559/0xc60 io_buffers_select+0x1c1/0x460 io_send+0x770/0x1050 Fix this by deferring the free of the old cached iovec until validation has succeeded. On failure, free the newly allocated iovec and leave the request pointing at the original one. change log: v2: slimming v1 patch Fixes: 46800585ae04 ("io_uring/kbuf: validate ring provided buffer addresses with access_ok()") Signed-off-by: Hao-Yu Yang --- io_uring/kbuf.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c index 3cd29477fff2..b6b969b55e12 100644 --- a/io_uring/kbuf.c +++ b/io_uring/kbuf.c @@ -287,8 +287,6 @@ static int io_ring_buffers_peek(struct io_kiocb *req, struct buf_sel_arg *arg, iov = kmalloc_objs(struct iovec, nr_avail); if (unlikely(!iov)) return -ENOMEM; - if (arg->mode & KBUF_MODE_FREE) - kfree(arg->iovs); arg->iovs = iov; nr_iovs = nr_avail; } else if (nr_avail < nr_iovs) { @@ -330,6 +328,9 @@ static int io_ring_buffers_peek(struct io_kiocb *req, struct buf_sel_arg *arg, buf = io_ring_head_to_buf(br, ++head, bl->mask); } while (--nr_iovs); + if (arg->mode & KBUF_MODE_FREE) + kfree(arg->iovs); + if (head == tail) req->flags |= REQ_F_BL_EMPTY; -- 2.34.1