From: Pavel Begunkov <asml.silence@gmail.com>
To: chase xd <sl1589472800@gmail.com>, Jens Axboe <axboe@kernel.dk>,
io-uring@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [io-uring] use-after-free in io_cqring_wait
Date: Thu, 12 Dec 2024 11:21:35 +0000 [thread overview]
Message-ID: <54192dd9-d4e6-49ba-82b4-01710d9f7925@gmail.com> (raw)
In-Reply-To: <CADZouDQ7TcKn8gz8_efnyAEp1JvU1ktRk8PWz-tO0FXUoh8VGQ@mail.gmail.com>
On 12/12/24 10:08, chase xd wrote:
> Syzkaller hit 'KASAN: use-after-free Read in io_cqring_wait' bug.
>
> ==================================================================
> BUG: KASAN: use-after-free in io_cqring_wait+0x16bc/0x1780
> io_uring/io_uring.c:2630
> Read of size 4 at addr ffff88807d128008 by task syz-executor994/8389
So kernel reads CQ head/tail and get a UAF. The ring was allocated
while resizing rings and was also deleted while resizing rings, but
those could be different resize attempts.
Jens, considering the lack of locking on the normal waiting path,
while swapping rings what prevents waiters from seeing an old ring?
I'd assume that's the problem at hand.
--
Pavel Begunkov
next prev parent reply other threads:[~2024-12-12 11:20 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-12-12 10:08 chase xd
2024-12-12 11:21 ` Pavel Begunkov [this message]
2024-12-12 11:30 ` Pavel Begunkov
2024-12-12 15:17 ` Jens Axboe
2024-12-12 15:16 ` Jens Axboe
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=54192dd9-d4e6-49ba-82b4-01710d9f7925@gmail.com \
--to=asml.silence@gmail.com \
--cc=axboe@kernel.dk \
--cc=io-uring@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=sl1589472800@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®