| Message ID | 20230321194300.405130-1-sd7.dev@pm.me (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | io_uring/rsrc: fix null-ptr-deref in io_file_bitmap_get() | expand |
On Tue, 21 Mar 2023 19:44:02 +0000, Savino Dicanosa wrote: > When fixed files are unregistered, file_alloc_end and alloc_hint > are not cleared. This can later cause a NULL pointer dereference in > io_file_bitmap_get() if auto index selection is enabled via > IORING_FILE_INDEX_ALLOC: > > [ 6.519129] BUG: kernel NULL pointer dereference, address: 0000000000000000 > [...] > [ 6.541468] RIP: 0010:_find_next_zero_bit+0x1a/0x70 > [...] > [ 6.560906] Call Trace: > [ 6.561322] <TASK> > [ 6.561672] io_file_bitmap_get+0x38/0x60 > [ 6.562281] io_fixed_fd_install+0x63/0xb0 > [ 6.562851] ? __pfx_io_socket+0x10/0x10 > [ 6.563396] io_socket+0x93/0xf0 > [ 6.563855] ? __pfx_io_socket+0x10/0x10 > [ 6.564411] io_issue_sqe+0x5b/0x3d0 > [ 6.564914] io_submit_sqes+0x1de/0x650 > [ 6.565452] __do_sys_io_uring_enter+0x4fc/0xb20 > [ 6.566083] ? __do_sys_io_uring_register+0x11e/0xd80 > [ 6.566779] do_syscall_64+0x3c/0x90 > [ 6.567247] entry_SYSCALL_64_after_hwframe+0x72/0xdc > [...] > > [...] Applied, thanks! [1/1] io_uring/rsrc: fix null-ptr-deref in io_file_bitmap_get() commit: 761efd55a0227aca3a69deacdaa112fffd44fe37 Best regards,
diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c index e2bac9f89902..7a43aed8e395 100644 --- a/io_uring/rsrc.c +++ b/io_uring/rsrc.c @@ -794,6 +794,7 @@ void __io_sqe_files_unregister(struct io_ring_ctx *ctx) } #endif io_free_file_tables(&ctx->file_table); + io_file_table_set_alloc_range(ctx, 0, 0); io_rsrc_data_free(ctx->file_data); ctx->file_data = NULL; ctx->nr_user_files = 0;
When fixed files are unregistered, file_alloc_end and alloc_hint are not cleared. This can later cause a NULL pointer dereference in io_file_bitmap_get() if auto index selection is enabled via IORING_FILE_INDEX_ALLOC: [ 6.519129] BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] [ 6.541468] RIP: 0010:_find_next_zero_bit+0x1a/0x70 [...] [ 6.560906] Call Trace: [ 6.561322] <TASK> [ 6.561672] io_file_bitmap_get+0x38/0x60 [ 6.562281] io_fixed_fd_install+0x63/0xb0 [ 6.562851] ? __pfx_io_socket+0x10/0x10 [ 6.563396] io_socket+0x93/0xf0 [ 6.563855] ? __pfx_io_socket+0x10/0x10 [ 6.564411] io_issue_sqe+0x5b/0x3d0 [ 6.564914] io_submit_sqes+0x1de/0x650 [ 6.565452] __do_sys_io_uring_enter+0x4fc/0xb20 [ 6.566083] ? __do_sys_io_uring_register+0x11e/0xd80 [ 6.566779] do_syscall_64+0x3c/0x90 [ 6.567247] entry_SYSCALL_64_after_hwframe+0x72/0xdc [...] To fix the issue, set file alloc range and alloc_hint to zero after file tables are freed. Fixes: 4278a0deb1f6 ("io_uring: defer alloc_hint update to io_file_bitmap_set()") Signed-off-by: Savino Dicanosa <sd7.dev@pm.me> --- io_uring/rsrc.c | 1 + 1 file changed, 1 insertion(+) -- 2.30.2