From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out30-111.freemail.mail.aliyun.com (out30-111.freemail.mail.aliyun.com [115.124.30.111]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 374C730BB8A for ; Fri, 6 Feb 2026 07:11:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=115.124.30.111 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770361898; cv=none; b=Ngl8Z9B/XD2Xv/C8W4uOvdAC2nmKqj9D0VkRbf5u0ppYkK7CwCSvkd0W23iD6do8llXliemVD6WBXDM3ODKj7iMKApl4xBVRtEh1g9bgA2E2D0cPVzVOkBlyuKIBuZnJCpwrUiI1mcTnS67UITS0BvvZIRkkt+97KH8RgAYNYTk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770361898; c=relaxed/simple; bh=gLjbYJYR8GKU3KlY4fe9/+qEZylWDH5l5gQZlBhxgA4=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=FcqL92o008IUAo7t89YP5Y+Ci/sh+aRZCSMxupQVMdtMbfuCj4JxMh0lR/5wATbttfZDBgbbLh4ZZV/OKI805oMbreWT8hAnfyrMc9kHB1pRyQH2z2UBbfTPj+kT/gT4t1vitekmItfQCETwrOTc9/4O/4XFKWPdJE2ttP7aBzs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.alibaba.com; spf=pass smtp.mailfrom=linux.alibaba.com; dkim=pass (1024-bit key) header.d=linux.alibaba.com header.i=@linux.alibaba.com header.b=Tgv9A2xX; arc=none smtp.client-ip=115.124.30.111 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.alibaba.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.alibaba.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.alibaba.com header.i=@linux.alibaba.com header.b="Tgv9A2xX" DKIM-Signature:v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.alibaba.com; s=default; t=1770361888; h=Message-ID:Date:MIME-Version:Subject:To:From:Content-Type; bh=73E12KM7OPacSNBdFgE+X8jRF2V44mwSSiTiiiemsUQ=; b=Tgv9A2xX33dkqBvuK5C9a5EBhOruGGur+HTfTJgqVkSG63kG6ts1S73kGsSzfYhDxdz+B8md3V66/aTtXjRCcwXilhzT9C6wj6M8vGssii3wBE4Iri7MjzQOu6OHfL3ZHHqL4rgNjfd2V1VEKniuCV64WZ4epXQLRfRaDoKgY9k= Received: from 30.221.130.105(mailfrom:hsiangkao@linux.alibaba.com fp:SMTPD_---0WydhgzM_1770361887 cluster:ay36) by smtp.aliyun-inc.com; Fri, 06 Feb 2026 15:11:28 +0800 Message-ID: <9d70646b-ddf8-42b5-8015-fb54a6f24296@linux.alibaba.com> Date: Fri, 6 Feb 2026 15:11:27 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] erofs: fix UAF issue in erofs_fileio_rq_submit() To: Chao Yu , xiang@kernel.org Cc: linux-erofs@lists.ozlabs.org, linux-kernel@vger.kernel.org, stable@kernel.org References: <20260205223005.72727-1-chao@kernel.org> From: Gao Xiang In-Reply-To: <20260205223005.72727-1-chao@kernel.org> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Hi Chao, On 2026/2/6 06:30, Chao Yu wrote: > [ 9.269940][ T3222] Call trace: > [ 9.269948][ T3222] ext4_file_read_iter+0xac/0x108 > [ 9.269979][ T3222] vfs_iocb_iter_read+0xac/0x198 > [ 9.269993][ T3222] erofs_fileio_rq_submit+0x12c/0x180 > [ 9.270008][ T3222] erofs_fileio_submit_bio+0x14/0x24 > [ 9.270030][ T3222] z_erofs_runqueue+0x834/0x8ac > [ 9.270054][ T3222] z_erofs_read_folio+0x120/0x220 > [ 9.270083][ T3222] filemap_read_folio+0x60/0x120 > [ 9.270102][ T3222] filemap_fault+0xcac/0x1060 > [ 9.270119][ T3222] do_pte_missing+0x2d8/0x1554 > [ 9.270131][ T3222] handle_mm_fault+0x5ec/0x70c > [ 9.270142][ T3222] do_page_fault+0x178/0x88c > [ 9.270167][ T3222] do_translation_fault+0x38/0x54 > [ 9.270183][ T3222] do_mem_abort+0x54/0xac > [ 9.270208][ T3222] el0_da+0x44/0x7c > [ 9.270227][ T3222] el0t_64_sync_handler+0x5c/0xf4 > [ 9.270253][ T3222] el0t_64_sync+0x1bc/0x1c0 > > erofs may encounter above panic when enabling file-backed mount w/ directio > mount option, the root cause is it may suffer UAF in below race condition: > > - z_erofs_read_folio wq s_dio_done_wq > - z_erofs_runqueue > - erofs_fileio_submit_bio > - erofs_fileio_rq_submit > - vfs_iocb_iter_read > - ext4_file_read_iter > - ext4_dio_read_iter > - iomap_dio_rw > : bio was submitted and return -EIOCBQUEUED > - dio_aio_complete_work > - dio_complete > - dio->iocb->ki_complete (erofs_fileio_ki_complete()) > - kfree(rq) > : it frees iocb, iocb.ki_filp can be UAF in file_accessed(). > - file_accessed > : access NULL file point > > Introduce a reference count in struct erofs_fileio_rq, and initialize it > as two, both erofs_fileio_ki_complete() and erofs_fileio_rq_submit() will > decrease reference count, the last one decreasing the reference count > to zero will free rq. > > Cc: stable@kernel.org > Fixes: fb176750266a ("erofs: add file-backed mount support") > Signed-off-by: Chao Yu Thanks for catching this: I will update the subject as "erofs: fix UAF issue for file-backed mounts w/ directio" to make it more clear about the impacts. Reviewed-by: Gao Xiang Thanks, Gao Xiang