From nobody Sat Jul 25 01:24:24 2026 Received: from mail-pg1-f180.google.com (mail-pg1-f180.google.com [209.85.215.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6E60B3C0617 for ; Tue, 21 Jul 2026 08:47:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.180 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784623679; cv=none; b=TnN8v9BE85IYrfIYh1ziE0ALzuUnfZnXud0VVmChKrXinxIV+Lap434314+D74Dyy4JcOBXJEGEQ+NKrS4+Skiox6czN6zelN5JDSsA6hnl4AamQZQuvn9Pwm+5jwcol1mt9LO6m1Qs800jMLBEzmAjRG54ET+yFdVrDEFufsp4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784623679; c=relaxed/simple; bh=GfEQ+OwxXQ1nHICDvlfRs2eTprljHrRRY34VzbIVR1Y=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=XtIOhGj40EHZ8rl3b04bLJ/25q1j2TL4pghXihOOCuXZ6zPZCcQVruLYgNjnrcVqXeKcL1XNuS0b/2pYzEVRWy/5UN4E1YZH9JsUqyn5CXgtTPQVL48IKfUm0GEjeG7M8QrBUuwpZdwcB6CEDBHcWTP6nW/wGTuph86U8OP1nJU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=NQjTxS2S; arc=none smtp.client-ip=209.85.215.180 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="NQjTxS2S" Received: by mail-pg1-f180.google.com with SMTP id 41be03b00d2f7-c9cf07d2df6so6948115a12.2 for ; Tue, 21 Jul 2026 01:47:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784623678; x=1785228478; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=nV3q+eHhbCfmvIKYJNzhZ7doa4w8F1rofh6XZPW6Qlg=; b=NQjTxS2S9mjydB0pyasom6b5emXFYMfM/RMIN//65Uhncd127sdURN6lLmcJLQbt/L nC8d8de16dIeYoNEWoN3sILRC3dJiGGsi6mFIFwmKKLJlN7CdmYr2hjE3j68TZJhfITn pGzF7OP/DZkQ4rGP9pWxFk57HzpFAWcBPxrNs6ASWKnTjsJTAS1/A564U59GZElDcuyl Hd7eCKf+4NoLl2o1EJ8Qq46Xqvx2H64BqHDVGsXQFlkfVMxF5POzyrRaV0Z3zmX8Pyae kcFd+JDCwAfsl8hrhgCSq2QJDY2+x+mN9PzdSzTMluRZBq+jTBqSD0q1iX4KDgmpUpIf SLQg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784623678; x=1785228478; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=nV3q+eHhbCfmvIKYJNzhZ7doa4w8F1rofh6XZPW6Qlg=; b=Ci+V4hV/GqcHT18/It+uAo492TisDuGy3BMBnJ6EJVCJL6Wu4S7kuAq0726+6o0haK mUN3XB5yVMBA+p8Oud7qSyBQciV0UeKsZZ8jHXSAHbvc1PyglS09xOSstVYtzFHINCgl QmA6Pu6x2Pe4y4QR4zIcpvpfCp2R0K76UWnDj+BYO21s+dHufIrjaaPOFiatr5oCP3zk VAkfksL0rzuHmX7N67huPOpcSYDff1u1hCVYVyH97H8W1v35L7FDu4rNlysInTVxpZC5 rOFnt8r3fMxf288wZPfjELsG3QtpTlBHv9sq7zNJ7i76u1i5b5GIOe+J7/brz7yEHlM1 xWrA== X-Forwarded-Encrypted: i=1; AHgh+RoB7EfafTUi1kDXtsgNJCe6FU1GftfDC68/s8SS3V+Yo36lM23yC0CXcl18TL5F729icixNIAIAZ3sC574=@vger.kernel.org X-Gm-Message-State: AOJu0Yw3oWYSsPwJLjWN+b4uQRbyRlYA6aXx+JTFgkPtONEiLPc5a3iL cU85xUPzRg5bx2dzorin+Da/gpThX8DebGEQXSIQlVrs6YjSsElvEw5Z X-Gm-Gg: AfdE7ck32ovk0IC3Wxha6h1MXSR+G7PG34jAQVs7mNys1nUAqC9BaiaIJMx+gYRLGy5 PvdQeb8EFoz2mRKpPj1At0Y6YwQltBV7A83l+mZyuS396ZTLI0hRpCPjQ3t8QLSkUX/34gxIFfT 0q9QrIdY3EZGQz3Lr0RV88JXNlbQpEicNZ8FQpoiCY4QIXMHyq+SL+qO8GCKnGZ5qPSYsMYsGew eCdNptOZJ1KcZZw3LoXrDQDuqbv56FbJRtnDg7wPgvLKSGjxDSAJ94J5kn5pPIX4UXcmreJzTHg nDJq30sB50BPfdJA8xGujZryePD26tb9JsI8UiYxS4NJSaUUixHt51uonE3k3JVAKg19mGA2AQD CjYufQ+2lbK2bUBQoU+aRI+O+gatq+JT5xykXQwT+7+lWz7WMHXLBLDJQXcSMFFpo/VovWaD+vh ufUQEvy7xXhC5PtYUusI/puCQjCfgyzJ+Wv1LYQyre7DTkRro= X-Received: by 2002:a05:6a20:d52f:b0:3bf:aa1a:d2ef with SMTP id adf61e73a8af0-3c3ad938d60mr19800362637.56.1784623677775; Tue, 21 Jul 2026 01:47:57 -0700 (PDT) Received: from localhost.localdomain ([125.20.165.194]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3142a1ddeb6sm50740915eec.20.2026.07.21.01.47.55 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Tue, 21 Jul 2026 01:47:57 -0700 (PDT) From: Aayush7352 To: io-uring@vger.kernel.org Cc: Jens Axboe , linux-kernel@vger.kernel.org, Aayush7352 Subject: [PATCH] io_uring/kbuf: fix UAF in buffer selection when access_ok fails on expanded iovec Date: Tue, 21 Jul 2026 14:17:52 +0530 Message-ID: <20260721084752.79346-1-aayushdixit924@gmail.com> X-Mailer: git-send-email 2.55.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" In io_ring_buffers_peek(), when the buffer ring is expanded (KBUF_MODE_EXPAND), arg->iovs is set to a newly kmalloced array. If access_ok() then fails on a buffer entry, the error path kfrees the new array but does not restore arg->iovs to the original value (org_iovs). arg->iovs is left dangling and will be reused on retry, causing a use-after-free when the caller retries the buffer selection. Fix by restoring arg->iovs =3D org_iovs after the kfree on the error path, so the caller's state remains coherent on retry. Fixes: b3e0216c97e3 ("io_uring: add buffer ring support") Cc: io-uring@vger.kernel.org Signed-off-by: Aayush7352 --- io_uring/kbuf.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c index de0129bce..eab4de8a7 100644 --- a/io_uring/kbuf.c +++ b/io_uring/kbuf.c @@ -314,8 +314,10 @@ static int io_ring_buffers_peek(struct io_kiocb *req, = struct buf_sel_arg *arg, iov->iov_base =3D u64_to_user_ptr(READ_ONCE(buf->addr)); iov->iov_len =3D len; if (unlikely(!access_ok(iov->iov_base, len))) { - if (arg->iovs !=3D org_iovs) + if (arg->iovs !=3D org_iovs) { kfree(arg->iovs); + arg->iovs =3D org_iovs; + } return -EFAULT; } iov++; --=20 2.55.0