Re: [PATCH v1] io_uring: fix dangling iovec after provided-buffer bundle grow failure

[Jens Axboe]

On 7/6/26 11:34 AM, Hao-Yu Yang wrote:
> On Mon, Jul 06, 2026 at 11:13:55AM -0600, Jens Axboe wrote:
>> On 7/6/26 11:01 AM, Hao-Yu Yang wrote:
>>> Sorry, i forgot to cc others mail
>>>
>>> I discovered and wrote the PoC myself. Trigger way is
>>>  send1: Submit an IORING_OP_SEND request with four valid
>>>  provided buffers. The system will allocate and cache an
>>>  iovec array (of size 4) for this request and store the
>>>  pointer in kmsg->vec.iovec.
>>>
>>>  send2: Submit a second send request with 8, and I set
>>>  the fourth passed-in address to point to an invalid address.
>>>  Now kmsg still hold old iovec, but old iovec object have
>>>  been freed.
>>>
>>>  So this will lead dangling pointer.
>>
>> Side note: please don't top post, linux mailing lists always reply
>> under the text for better readability. Top posting turns any kind
>> of threaded conversation into both a mess, and it's also wasteful.
>>
>> Great thanks! Want to turn this into a liburing test case? Then we can
>> include it there as well, and it'd catch both UAF and memory leaks when
>> run.
>>
>> -- 
>> Jens Axboe
> 
> How to turn this into a liburing test case? Should this be included in
> the v2 patch?

Look at the tests in test/ in liburing. Or just send the reproducer and
I can get it turned into a test case.

Should be separate from a kernel patch, it's a patch for an entirely
different repository.


-- 
Jens Axboe