* [PATCH] io_uring/rsrc: fix null-ptr-deref in io_file_bitmap_get()
@ 2023-03-21 19:44 Savino Dicanosa
2023-03-21 19:45 ` Jens Axboe
2023-03-21 19:57 ` Jens Axboe
0 siblings, 2 replies; 3+ messages in thread
From: Savino Dicanosa @ 2023-03-21 19:44 UTC (permalink / raw)
To: io-uring; +Cc: axboe, asml.silence, Savino Dicanosa
When fixed files are unregistered, file_alloc_end and alloc_hint
are not cleared. This can later cause a NULL pointer dereference in
io_file_bitmap_get() if auto index selection is enabled via
IORING_FILE_INDEX_ALLOC:
[ 6.519129] BUG: kernel NULL pointer dereference, address: 0000000000000000
[...]
[ 6.541468] RIP: 0010:_find_next_zero_bit+0x1a/0x70
[...]
[ 6.560906] Call Trace:
[ 6.561322] <TASK>
[ 6.561672] io_file_bitmap_get+0x38/0x60
[ 6.562281] io_fixed_fd_install+0x63/0xb0
[ 6.562851] ? __pfx_io_socket+0x10/0x10
[ 6.563396] io_socket+0x93/0xf0
[ 6.563855] ? __pfx_io_socket+0x10/0x10
[ 6.564411] io_issue_sqe+0x5b/0x3d0
[ 6.564914] io_submit_sqes+0x1de/0x650
[ 6.565452] __do_sys_io_uring_enter+0x4fc/0xb20
[ 6.566083] ? __do_sys_io_uring_register+0x11e/0xd80
[ 6.566779] do_syscall_64+0x3c/0x90
[ 6.567247] entry_SYSCALL_64_after_hwframe+0x72/0xdc
[...]
To fix the issue, set file alloc range and alloc_hint to zero after
file tables are freed.
Fixes: 4278a0deb1f6 ("io_uring: defer alloc_hint update to io_file_bitmap_set()")
Signed-off-by: Savino Dicanosa <[email protected]>
---
io_uring/rsrc.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c
index e2bac9f89902..7a43aed8e395 100644
--- a/io_uring/rsrc.c
+++ b/io_uring/rsrc.c
@@ -794,6 +794,7 @@ void __io_sqe_files_unregister(struct io_ring_ctx *ctx)
}
#endif
io_free_file_tables(&ctx->file_table);
+ io_file_table_set_alloc_range(ctx, 0, 0);
io_rsrc_data_free(ctx->file_data);
ctx->file_data = NULL;
ctx->nr_user_files = 0;
--
2.30.2
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] io_uring/rsrc: fix null-ptr-deref in io_file_bitmap_get()
2023-03-21 19:44 [PATCH] io_uring/rsrc: fix null-ptr-deref in io_file_bitmap_get() Savino Dicanosa
@ 2023-03-21 19:45 ` Jens Axboe
2023-03-21 19:57 ` Jens Axboe
1 sibling, 0 replies; 3+ messages in thread
From: Jens Axboe @ 2023-03-21 19:45 UTC (permalink / raw)
To: Savino Dicanosa, io-uring; +Cc: asml.silence
On 3/21/23 1:44 PM, Savino Dicanosa wrote:
> When fixed files are unregistered, file_alloc_end and alloc_hint
> are not cleared. This can later cause a NULL pointer dereference in
> io_file_bitmap_get() if auto index selection is enabled via
> IORING_FILE_INDEX_ALLOC:
>
> [ 6.519129] BUG: kernel NULL pointer dereference, address: 0000000000000000
> [...]
> [ 6.541468] RIP: 0010:_find_next_zero_bit+0x1a/0x70
> [...]
> [ 6.560906] Call Trace:
> [ 6.561322] <TASK>
> [ 6.561672] io_file_bitmap_get+0x38/0x60
> [ 6.562281] io_fixed_fd_install+0x63/0xb0
> [ 6.562851] ? __pfx_io_socket+0x10/0x10
> [ 6.563396] io_socket+0x93/0xf0
> [ 6.563855] ? __pfx_io_socket+0x10/0x10
> [ 6.564411] io_issue_sqe+0x5b/0x3d0
> [ 6.564914] io_submit_sqes+0x1de/0x650
> [ 6.565452] __do_sys_io_uring_enter+0x4fc/0xb20
> [ 6.566083] ? __do_sys_io_uring_register+0x11e/0xd80
> [ 6.566779] do_syscall_64+0x3c/0x90
> [ 6.567247] entry_SYSCALL_64_after_hwframe+0x72/0xdc
> [...]
>
> To fix the issue, set file alloc range and alloc_hint to zero after
> file tables are freed.
>
> Fixes: 4278a0deb1f6 ("io_uring: defer alloc_hint update to io_file_bitmap_set()")
> Signed-off-by: Savino Dicanosa <[email protected]>
> ---
> io_uring/rsrc.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c
> index e2bac9f89902..7a43aed8e395 100644
> --- a/io_uring/rsrc.c
> +++ b/io_uring/rsrc.c
> @@ -794,6 +794,7 @@ void __io_sqe_files_unregister(struct io_ring_ctx *ctx)
> }
> #endif
> io_free_file_tables(&ctx->file_table);
> + io_file_table_set_alloc_range(ctx, 0, 0);
> io_rsrc_data_free(ctx->file_data);
> ctx->file_data = NULL;
> ctx->nr_user_files = 0;
That looks good. Do you happen to have a test case as well? Would be nice
to add that to the liburing regression tests.
--
Jens Axboe
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] io_uring/rsrc: fix null-ptr-deref in io_file_bitmap_get()
2023-03-21 19:44 [PATCH] io_uring/rsrc: fix null-ptr-deref in io_file_bitmap_get() Savino Dicanosa
2023-03-21 19:45 ` Jens Axboe
@ 2023-03-21 19:57 ` Jens Axboe
1 sibling, 0 replies; 3+ messages in thread
From: Jens Axboe @ 2023-03-21 19:57 UTC (permalink / raw)
To: io-uring, Savino Dicanosa; +Cc: asml.silence
On Tue, 21 Mar 2023 19:44:02 +0000, Savino Dicanosa wrote:
> When fixed files are unregistered, file_alloc_end and alloc_hint
> are not cleared. This can later cause a NULL pointer dereference in
> io_file_bitmap_get() if auto index selection is enabled via
> IORING_FILE_INDEX_ALLOC:
>
> [ 6.519129] BUG: kernel NULL pointer dereference, address: 0000000000000000
> [...]
> [ 6.541468] RIP: 0010:_find_next_zero_bit+0x1a/0x70
> [...]
> [ 6.560906] Call Trace:
> [ 6.561322] <TASK>
> [ 6.561672] io_file_bitmap_get+0x38/0x60
> [ 6.562281] io_fixed_fd_install+0x63/0xb0
> [ 6.562851] ? __pfx_io_socket+0x10/0x10
> [ 6.563396] io_socket+0x93/0xf0
> [ 6.563855] ? __pfx_io_socket+0x10/0x10
> [ 6.564411] io_issue_sqe+0x5b/0x3d0
> [ 6.564914] io_submit_sqes+0x1de/0x650
> [ 6.565452] __do_sys_io_uring_enter+0x4fc/0xb20
> [ 6.566083] ? __do_sys_io_uring_register+0x11e/0xd80
> [ 6.566779] do_syscall_64+0x3c/0x90
> [ 6.567247] entry_SYSCALL_64_after_hwframe+0x72/0xdc
> [...]
>
> [...]
Applied, thanks!
[1/1] io_uring/rsrc: fix null-ptr-deref in io_file_bitmap_get()
commit: 761efd55a0227aca3a69deacdaa112fffd44fe37
Best regards,
--
Jens Axboe
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2023-03-21 19:57 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-03-21 19:44 [PATCH] io_uring/rsrc: fix null-ptr-deref in io_file_bitmap_get() Savino Dicanosa
2023-03-21 19:45 ` Jens Axboe
2023-03-21 19:57 ` Jens Axboe
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox