Re: [PATCH v2] io_uring: fix dangling iovec after provided-buffer bundle grow failure

[Jens Axboe]

On Tue, 07 Jul 2026 02:33:04 +0800, Hao-Yu Yang wrote:
> When growing a provided-buffer bundle, the old cached iovec is freed
> before the new buffers have all been validated. If validation fails, the
> request still points at the freed iovec, which can be freed again during
> completion cleanup.
> 
> BUG: KASAN: double-free in io_vec_free+0x2c/0x90
> Freed by task 73:
>  kfree+0x104/0x3b0
>  io_vec_free+0x2c/0x90
>  __io_submit_flush_completions+0xc03/0x1e40
>  io_submit_sqes+0xdb5/0x2310
> 
> [...]

Applied, thanks!

[1/1] io_uring: fix dangling iovec after provided-buffer bundle grow failure
      commit: cd053d788c3f13b3eaf16672d427ee828fda16ed

Best regards,
-- 
Jens Axboe