fs/erofs/fileio.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
[ 9.269940][ T3222] Call trace:
[ 9.269948][ T3222] ext4_file_read_iter+0xac/0x108
[ 9.269979][ T3222] vfs_iocb_iter_read+0xac/0x198
[ 9.269993][ T3222] erofs_fileio_rq_submit+0x12c/0x180
[ 9.270008][ T3222] erofs_fileio_submit_bio+0x14/0x24
[ 9.270030][ T3222] z_erofs_runqueue+0x834/0x8ac
[ 9.270054][ T3222] z_erofs_read_folio+0x120/0x220
[ 9.270083][ T3222] filemap_read_folio+0x60/0x120
[ 9.270102][ T3222] filemap_fault+0xcac/0x1060
[ 9.270119][ T3222] do_pte_missing+0x2d8/0x1554
[ 9.270131][ T3222] handle_mm_fault+0x5ec/0x70c
[ 9.270142][ T3222] do_page_fault+0x178/0x88c
[ 9.270167][ T3222] do_translation_fault+0x38/0x54
[ 9.270183][ T3222] do_mem_abort+0x54/0xac
[ 9.270208][ T3222] el0_da+0x44/0x7c
[ 9.270227][ T3222] el0t_64_sync_handler+0x5c/0xf4
[ 9.270253][ T3222] el0t_64_sync+0x1bc/0x1c0
erofs may encounter above panic when enabling file-backed mount w/ directio
mount option, the root cause is it may suffer UAF in below race condition:
- z_erofs_read_folio wq s_dio_done_wq
- z_erofs_runqueue
- erofs_fileio_submit_bio
- erofs_fileio_rq_submit
- vfs_iocb_iter_read
- ext4_file_read_iter
- ext4_dio_read_iter
- iomap_dio_rw
: bio was submitted and return -EIOCBQUEUED
- dio_aio_complete_work
- dio_complete
- dio->iocb->ki_complete (erofs_fileio_ki_complete())
- kfree(rq)
: it frees iocb, iocb.ki_filp can be UAF in file_accessed().
- file_accessed
: access NULL file point
Introduce a reference count in struct erofs_fileio_rq, and initialize it
as two, both erofs_fileio_ki_complete() and erofs_fileio_rq_submit() will
decrease reference count, the last one decreasing the reference count
to zero will free rq.
Cc: stable@kernel.org
Fixes: fb176750266a ("erofs: add file-backed mount support")
Signed-off-by: Chao Yu <chao@kernel.org>
---
fs/erofs/fileio.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/fs/erofs/fileio.c b/fs/erofs/fileio.c
index 43998fe1cce1..4d5054dcac95 100644
--- a/fs/erofs/fileio.c
+++ b/fs/erofs/fileio.c
@@ -10,6 +10,7 @@ struct erofs_fileio_rq {
struct bio bio;
struct kiocb iocb;
struct super_block *sb;
+ refcount_t ref;
};
struct erofs_fileio {
@@ -38,7 +39,8 @@ static void erofs_fileio_ki_complete(struct kiocb *iocb, long ret)
}
bio_endio(&rq->bio);
bio_uninit(&rq->bio);
- kfree(rq);
+ if (refcount_dec_and_test(&rq->ref))
+ kfree(rq);
}
static void erofs_fileio_rq_submit(struct erofs_fileio_rq *rq)
@@ -60,6 +62,8 @@ static void erofs_fileio_rq_submit(struct erofs_fileio_rq *rq)
ret = vfs_iocb_iter_read(rq->iocb.ki_filp, &rq->iocb, &iter);
if (ret != -EIOCBQUEUED)
erofs_fileio_ki_complete(&rq->iocb, ret);
+ if (refcount_dec_and_test(&rq->ref))
+ kfree(rq);
}
static struct erofs_fileio_rq *erofs_fileio_rq_alloc(struct erofs_map_dev *mdev)
@@ -70,6 +74,7 @@ static struct erofs_fileio_rq *erofs_fileio_rq_alloc(struct erofs_map_dev *mdev)
bio_init(&rq->bio, NULL, rq->bvecs, ARRAY_SIZE(rq->bvecs), REQ_OP_READ);
rq->iocb.ki_filp = mdev->m_dif->file;
rq->sb = mdev->m_sb;
+ refcount_set(&rq->ref, 2);
return rq;
}
--
2.40.1Hi Chao,
On 2026/2/6 06:30, Chao Yu wrote:
> [ 9.269940][ T3222] Call trace:
> [ 9.269948][ T3222] ext4_file_read_iter+0xac/0x108
> [ 9.269979][ T3222] vfs_iocb_iter_read+0xac/0x198
> [ 9.269993][ T3222] erofs_fileio_rq_submit+0x12c/0x180
> [ 9.270008][ T3222] erofs_fileio_submit_bio+0x14/0x24
> [ 9.270030][ T3222] z_erofs_runqueue+0x834/0x8ac
> [ 9.270054][ T3222] z_erofs_read_folio+0x120/0x220
> [ 9.270083][ T3222] filemap_read_folio+0x60/0x120
> [ 9.270102][ T3222] filemap_fault+0xcac/0x1060
> [ 9.270119][ T3222] do_pte_missing+0x2d8/0x1554
> [ 9.270131][ T3222] handle_mm_fault+0x5ec/0x70c
> [ 9.270142][ T3222] do_page_fault+0x178/0x88c
> [ 9.270167][ T3222] do_translation_fault+0x38/0x54
> [ 9.270183][ T3222] do_mem_abort+0x54/0xac
> [ 9.270208][ T3222] el0_da+0x44/0x7c
> [ 9.270227][ T3222] el0t_64_sync_handler+0x5c/0xf4
> [ 9.270253][ T3222] el0t_64_sync+0x1bc/0x1c0
>
> erofs may encounter above panic when enabling file-backed mount w/ directio
> mount option, the root cause is it may suffer UAF in below race condition:
>
> - z_erofs_read_folio wq s_dio_done_wq
> - z_erofs_runqueue
> - erofs_fileio_submit_bio
> - erofs_fileio_rq_submit
> - vfs_iocb_iter_read
> - ext4_file_read_iter
> - ext4_dio_read_iter
> - iomap_dio_rw
> : bio was submitted and return -EIOCBQUEUED
> - dio_aio_complete_work
> - dio_complete
> - dio->iocb->ki_complete (erofs_fileio_ki_complete())
> - kfree(rq)
> : it frees iocb, iocb.ki_filp can be UAF in file_accessed().
> - file_accessed
> : access NULL file point
>
> Introduce a reference count in struct erofs_fileio_rq, and initialize it
> as two, both erofs_fileio_ki_complete() and erofs_fileio_rq_submit() will
> decrease reference count, the last one decreasing the reference count
> to zero will free rq.
>
> Cc: stable@kernel.org
> Fixes: fb176750266a ("erofs: add file-backed mount support")
> Signed-off-by: Chao Yu <chao@kernel.org>
Thanks for catching this:
I will update the subject as
"erofs: fix UAF issue for file-backed mounts w/ directio"
to make it more clear about the impacts.
Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Thanks,
Gao Xiang
Xiang,
On 2/6/2026 3:11 PM, Gao Xiang wrote:
> Hi Chao,
>
> On 2026/2/6 06:30, Chao Yu wrote:
>> [ 9.269940][ T3222] Call trace:
>> [ 9.269948][ T3222] ext4_file_read_iter+0xac/0x108
>> [ 9.269979][ T3222] vfs_iocb_iter_read+0xac/0x198
>> [ 9.269993][ T3222] erofs_fileio_rq_submit+0x12c/0x180
>> [ 9.270008][ T3222] erofs_fileio_submit_bio+0x14/0x24
>> [ 9.270030][ T3222] z_erofs_runqueue+0x834/0x8ac
>> [ 9.270054][ T3222] z_erofs_read_folio+0x120/0x220
>> [ 9.270083][ T3222] filemap_read_folio+0x60/0x120
>> [ 9.270102][ T3222] filemap_fault+0xcac/0x1060
>> [ 9.270119][ T3222] do_pte_missing+0x2d8/0x1554
>> [ 9.270131][ T3222] handle_mm_fault+0x5ec/0x70c
>> [ 9.270142][ T3222] do_page_fault+0x178/0x88c
>> [ 9.270167][ T3222] do_translation_fault+0x38/0x54
>> [ 9.270183][ T3222] do_mem_abort+0x54/0xac
>> [ 9.270208][ T3222] el0_da+0x44/0x7c
>> [ 9.270227][ T3222] el0t_64_sync_handler+0x5c/0xf4
>> [ 9.270253][ T3222] el0t_64_sync+0x1bc/0x1c0
>>
>> erofs may encounter above panic when enabling file-backed mount w/ directio
>> mount option, the root cause is it may suffer UAF in below race condition:
>>
>> - z_erofs_read_folio wq s_dio_done_wq
>> - z_erofs_runqueue
>> - erofs_fileio_submit_bio
>> - erofs_fileio_rq_submit
>> - vfs_iocb_iter_read
>> - ext4_file_read_iter
>> - ext4_dio_read_iter
>> - iomap_dio_rw
>> : bio was submitted and return -EIOCBQUEUED
>> - dio_aio_complete_work
>> - dio_complete
>> - dio->iocb->ki_complete (erofs_fileio_ki_complete())
>> - kfree(rq)
>> : it frees iocb, iocb.ki_filp can be UAF in file_accessed().
>> - file_accessed
>> : access NULL file point
>>
>> Introduce a reference count in struct erofs_fileio_rq, and initialize it
>> as two, both erofs_fileio_ki_complete() and erofs_fileio_rq_submit() will
>> decrease reference count, the last one decreasing the reference count
>> to zero will free rq.
>>
>> Cc: stable@kernel.org
>> Fixes: fb176750266a ("erofs: add file-backed mount support")
>> Signed-off-by: Chao Yu <chao@kernel.org>
>
> Thanks for catching this:>
> I will update the subject as
> "erofs: fix UAF issue for file-backed mounts w/ directio"
>
> to make it more clear about the impacts.
Make sense to me, thanks for the review.
Thanks,
>
> Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com>
>
> Thanks,
> Gao Xiang
© 2016 - 2026 Red Hat, Inc.