Re: [PATCH] io_uring/kbuf: fix use-after-free of new iovec on bundle grow

[Gabriel Krisman Bertazi]

Breno Leitao <leitao@xxxxxxxxxx> writes:

> When io_ring_buffers_peek() grows a provided-buffer bundle, it allocates
> a new iovec array and points arg->iovs at it. The KBUF_MODE_FREE cleanup
> added at the end of the function then does kfree(arg->iovs), which frees
> this freshly allocated array that is about to be returned to and used by
> the caller, instead of the old cached iovec (org_iovs) it was meant to
> release. The caller reads the now-freed array, resulting in a
> use-after-free, easily triggered by the liburing recv-bundle-short-ooo
> test:
>
>   BUG: KASAN: slab-use-after-free in io_recv+0x4bc/0xc60
>   Read of size 8 at addr ffff00037b20c240 by task recv-bundle-sho
>    io_recv
>   Allocated by task:
>    __kmalloc_noprof
>    io_ring_buffers_peek
>    io_buffers_peek
>    io_recv
>   Freed by task:
>    kfree
>    io_ring_buffers_peek
>    io_buffers_peek
>    io_recv
>
> Free org_iovs instead, and only when it was actually replaced by a new
> allocation. On the access_ok() failure path the new array is already
> freed and the request is left pointing at the original iovec, so nothing
> needs to be released at this point in that case.
>
> Fixes: cd053d788c3f ("io_uring: fix dangling iovec after provided-buffer bundle grow failure")
> Signed-off-by: Breno Leitao <leitao@xxxxxxxxxx>

Already fixed here

https://lore.kernel.org/io-uring/20260712142612.188695595-iostreampy@xxxxxxxxx/T/#u

here:

https://lore.kernel.org/io-uring/OS3PR01MB8810F38D613E37FBD684DC4D83FB2@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/T/#t

and here:

https://lore.kernel.org/io-uring/20260713183124.4217-1-doruk@xxxxxxx/T/#u

Aren't LLMs fun?

-- 
Gabriel Krisman Bertazi