Re: [PATCH] io_uring/kbuf: fix UAF in buffer selection when access_ok fails on expanded iovec

[Jens Axboe]

On 7/21/26 3:57 AM, Aayush7352 wrote:
> From: Aayush Dixit <aayushdixit924@xxxxxxxxx>
> 
> In io_ring_buffers_peek(), when the buffer ring is expanded
> (KBUF_MODE_EXPAND), arg->iovs is set to a newly kmalloced array.
> If access_ok() then fails on a buffer entry, the error path kfrees
> the new array but does not restore arg->iovs to the original value
> (org_iovs).  arg->iovs is left dangling and will be reused on retry,
> causing a use-after-free when the caller retries the buffer selection.
> 
> Fix by restoring arg->iovs = org_iovs after the kfree on the error
> path, so the caller's state remains coherent on retry.

You sent this twice, replying once for both: this is bogus. If your
LLM thinks it found something, have it write a reproducer. Then YOU
reproduce, and then you can report it. Don't waste our time with
garbage like this.

> Fixes: b3e0216c97e3 ("io_uring: add buffer ring support")

This is also bogus, this sha doesn't exist.

-- 
Jens Axboe