[PATCH 1/1] io_uring/sqpoll: fix sqpoll error handling races

[PATCH 1/1] io_uring/sqpoll: fix sqpoll error handling races

[Pavel Begunkov]

BUG: KASAN: slab-use-after-free in __lock_acquire+0x370b/0x4a10 kernel/locking/lockdep.c:5089
Call Trace:
<TASK>
...
_raw_spin_lock_irqsave+0x3d/0x60 kernel/locking/spinlock.c:162
class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:551 [inline]
try_to_wake_up+0xb5/0x23c0 kernel/sched/core.c:4205
io_sq_thread_park+0xac/0xe0 io_uring/sqpoll.c:55
io_sq_thread_finish+0x6b/0x310 io_uring/sqpoll.c:96
io_sq_offload_create+0x162/0x11d0 io_uring/sqpoll.c:497
io_uring_create io_uring/io_uring.c:3724 [inline]
io_uring_setup+0x1728/0x3230 io_uring/io_uring.c:3806
...

Kun Hu reports that the SQPOLL creating error path has UAF, which
happens if io_uring_alloc_task_context() fails and then io_sq_thread()
manages to run and complete before the rest of error handling code,
which means io_sq_thread_finish() is looking at already killed task.

Cc: stable@vger.kernel.org
Reported-by: Kun Hu <huk23@m.fudan.edu.cn>
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
---
 io_uring/sqpoll.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/io_uring/sqpoll.c b/io_uring/sqpoll.c
index 6df5e649c413..9e5bd79fd2b5 100644
--- a/io_uring/sqpoll.c
+++ b/io_uring/sqpoll.c
@@ -405,6 +405,7 @@ void io_sqpoll_wait_sq(struct io_ring_ctx *ctx)
 __cold int io_sq_offload_create(struct io_ring_ctx *ctx,
 				struct io_uring_params *p)
 {
+	struct task_struct *task_to_put = NULL;
 	int ret;
 
 	/* Retain compatibility with failing for an invalid attach attempt */
@@ -480,6 +481,7 @@ __cold int io_sq_offload_create(struct io_ring_ctx *ctx,
 		}
 
 		sqd->thread = tsk;
+		task_to_put = get_task_struct(tsk);
 		ret = io_uring_alloc_task_context(tsk, ctx);
 		wake_up_new_task(tsk);
 		if (ret)
@@ -490,11 +492,15 @@ __cold int io_sq_offload_create(struct io_ring_ctx *ctx,
 		goto err;
 	}
 
+	if (task_to_put)
+		put_task_struct(task_to_put);
 	return 0;
 err_sqpoll:
 	complete(&ctx->sq_data->exited);
 err:
 	io_sq_thread_finish(ctx);
+	if (task_to_put)
+		put_task_struct(task_to_put);
 	return ret;
 }
 
-- 
2.47.1

Re: [PATCH 1/1] io_uring/sqpoll: fix sqpoll error handling races

[Jens Axboe]

On 12/26/24 9:49 AM, Pavel Begunkov wrote:
> BUG: KASAN: slab-use-after-free in __lock_acquire+0x370b/0x4a10 kernel/locking/lockdep.c:5089
> Call Trace:
> <TASK>
> ...
> _raw_spin_lock_irqsave+0x3d/0x60 kernel/locking/spinlock.c:162
> class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:551 [inline]
> try_to_wake_up+0xb5/0x23c0 kernel/sched/core.c:4205
> io_sq_thread_park+0xac/0xe0 io_uring/sqpoll.c:55
> io_sq_thread_finish+0x6b/0x310 io_uring/sqpoll.c:96
> io_sq_offload_create+0x162/0x11d0 io_uring/sqpoll.c:497
> io_uring_create io_uring/io_uring.c:3724 [inline]
> io_uring_setup+0x1728/0x3230 io_uring/io_uring.c:3806
> ...
> 
> Kun Hu reports that the SQPOLL creating error path has UAF, which
> happens if io_uring_alloc_task_context() fails and then io_sq_thread()
> manages to run and complete before the rest of error handling code,
> which means io_sq_thread_finish() is looking at already killed task.

Might be worth mentioning that this is only really a fault injection
thing. But ouside of that, looks fine to me - thanks!

-- 
Jens Axboe

Re: [PATCH 1/1] io_uring/sqpoll: fix sqpoll error handling races

[Jens Axboe]

On Thu, 26 Dec 2024 16:49:23 +0000, Pavel Begunkov wrote:
> BUG: KASAN: slab-use-after-free in __lock_acquire+0x370b/0x4a10 kernel/locking/lockdep.c:5089
> Call Trace:
> <TASK>
> ...
> _raw_spin_lock_irqsave+0x3d/0x60 kernel/locking/spinlock.c:162
> class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:551 [inline]
> try_to_wake_up+0xb5/0x23c0 kernel/sched/core.c:4205
> io_sq_thread_park+0xac/0xe0 io_uring/sqpoll.c:55
> io_sq_thread_finish+0x6b/0x310 io_uring/sqpoll.c:96
> io_sq_offload_create+0x162/0x11d0 io_uring/sqpoll.c:497
> io_uring_create io_uring/io_uring.c:3724 [inline]
> io_uring_setup+0x1728/0x3230 io_uring/io_uring.c:3806
> ...
> 
> [...]

Applied, thanks!

[1/1] io_uring/sqpoll: fix sqpoll error handling races
      commit: e33ac68e5e21ec1292490dfe061e75c0dbdd3bd4

Best regards,
-- 
Jens Axboe