From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 196A0279DB7 for ; Fri, 6 Feb 2026 07:15:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770362147; cv=none; b=AyyDu+UA8qBN4wPtqZ9pjdU3fnJrBPZ30oPmSEONym5Ed7lrKwHCR3BFs1kBJHcg475Lv+L3Xx4c7GuAbvv04TYpzH+BMY6mUhbVLt0LdCuKfzedZHqRUJ113TpYwkoR+cn5ic9n0zWx32hcii49luWptGz94PTUR5IQVlOl91s= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770362147; c=relaxed/simple; bh=4ZVaO3abGWbuKw2wFVB/tdoxncsSTd3KVe5B3yewX3A=; h=Message-ID:Date:MIME-Version:Cc:Subject:To:References:From: In-Reply-To:Content-Type; b=XqJm3poccqXNkWyR5MWBLRi75sIcqpXRiwdpZw+D8V4/q/l6CGkl5MvIx0860OniD+ki9YQyQlBADkdopkQyC8W3hIzwB0XftV0ITw7cVy1bZb36lqwuUNlKXBD7aQ6tIm08x5jXfZ+vp4mmMsebaNuHgZNQsRukLpHFJEVkjEA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=YHheAZxz; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="YHheAZxz" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0EAFEC116C6; Fri, 6 Feb 2026 07:15:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1770362146; bh=4ZVaO3abGWbuKw2wFVB/tdoxncsSTd3KVe5B3yewX3A=; h=Date:Cc:Subject:To:References:From:In-Reply-To:From; b=YHheAZxzeXjECpuOZUwZrci6BUSet8VrNZptMrAzKgqgkRRleGvWW+bB4Ow6V+yUo zc+DwXswW4gctPDJtfAv6QIzF9hoPIQ0EiENFbBCrOpU0DRcFQ3x50C/zsNbijGo8R LvfR1BFIciU2Dm/szgO6y/Ba9ikJ5lIyEOsXUG5zXBJXdEh37HEdaHhOt72ibSwTrF 1wP7Jc2HTwgVBa9SSOyJqvlSwCJyyA6Rdln7fDrbFWz8iNvj/DpQx8D8SvQR2wxp3L YHq8n5J9iEaZz6oMr9aLzRrn3J4dWo+xYo4ZVCF6BFDtRhug4YfXDDuN9/Cf4FNzbt 9Wudf22uOzpHg== Message-ID: <712352c3-c0a1-4e9f-a689-0761e7a2f197@kernel.org> Date: Fri, 6 Feb 2026 15:15:46 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Cc: chao@kernel.org, linux-erofs@lists.ozlabs.org, linux-kernel@vger.kernel.org, stable@kernel.org Subject: Re: [PATCH] erofs: fix UAF issue in erofs_fileio_rq_submit() To: Gao Xiang , xiang@kernel.org References: <20260205223005.72727-1-chao@kernel.org> <9d70646b-ddf8-42b5-8015-fb54a6f24296@linux.alibaba.com> Content-Language: en-US From: Chao Yu In-Reply-To: <9d70646b-ddf8-42b5-8015-fb54a6f24296@linux.alibaba.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Xiang, On 2/6/2026 3:11 PM, Gao Xiang wrote: > Hi Chao, > > On 2026/2/6 06:30, Chao Yu wrote: >> [ 9.269940][ T3222] Call trace: >> [ 9.269948][ T3222] ext4_file_read_iter+0xac/0x108 >> [ 9.269979][ T3222] vfs_iocb_iter_read+0xac/0x198 >> [ 9.269993][ T3222] erofs_fileio_rq_submit+0x12c/0x180 >> [ 9.270008][ T3222] erofs_fileio_submit_bio+0x14/0x24 >> [ 9.270030][ T3222] z_erofs_runqueue+0x834/0x8ac >> [ 9.270054][ T3222] z_erofs_read_folio+0x120/0x220 >> [ 9.270083][ T3222] filemap_read_folio+0x60/0x120 >> [ 9.270102][ T3222] filemap_fault+0xcac/0x1060 >> [ 9.270119][ T3222] do_pte_missing+0x2d8/0x1554 >> [ 9.270131][ T3222] handle_mm_fault+0x5ec/0x70c >> [ 9.270142][ T3222] do_page_fault+0x178/0x88c >> [ 9.270167][ T3222] do_translation_fault+0x38/0x54 >> [ 9.270183][ T3222] do_mem_abort+0x54/0xac >> [ 9.270208][ T3222] el0_da+0x44/0x7c >> [ 9.270227][ T3222] el0t_64_sync_handler+0x5c/0xf4 >> [ 9.270253][ T3222] el0t_64_sync+0x1bc/0x1c0 >> >> erofs may encounter above panic when enabling file-backed mount w/ directio >> mount option, the root cause is it may suffer UAF in below race condition: >> >> - z_erofs_read_folio wq s_dio_done_wq >> - z_erofs_runqueue >> - erofs_fileio_submit_bio >> - erofs_fileio_rq_submit >> - vfs_iocb_iter_read >> - ext4_file_read_iter >> - ext4_dio_read_iter >> - iomap_dio_rw >> : bio was submitted and return -EIOCBQUEUED >> - dio_aio_complete_work >> - dio_complete >> - dio->iocb->ki_complete (erofs_fileio_ki_complete()) >> - kfree(rq) >> : it frees iocb, iocb.ki_filp can be UAF in file_accessed(). >> - file_accessed >> : access NULL file point >> >> Introduce a reference count in struct erofs_fileio_rq, and initialize it >> as two, both erofs_fileio_ki_complete() and erofs_fileio_rq_submit() will >> decrease reference count, the last one decreasing the reference count >> to zero will free rq. >> >> Cc: stable@kernel.org >> Fixes: fb176750266a ("erofs: add file-backed mount support") >> Signed-off-by: Chao Yu > > Thanks for catching this:> > I will update the subject as > "erofs: fix UAF issue for file-backed mounts w/ directio" > > to make it more clear about the impacts. Make sense to me, thanks for the review. Thanks, > > Reviewed-by: Gao Xiang > > Thanks, > Gao Xiang