[PATCH v2] io_uring/rsrc: fix slab-out-of-bounds in io_buffer_register_bvec

[PATCH v2] io_uring/rsrc: fix slab-out-of-bounds in io_buffer_register_bvec

[veygax]

From: Evan Lambert <veyga@veygax.dev>

The function io_buffer_register_bvec() calculates the allocation size
for the io_mapped_ubuf based on blk_rq_nr_phys_segments(rq). This
function calculates the number of scatter-gather elements after merging
physically contiguous pages.

However, the subsequent loop uses rq_for_each_bvec() to populate the
array, which iterates over every individual bio_vec in the request,
regardless of physical contiguity.

If a request has multiple bio_vec entries that are physically
contiguous, blk_rq_nr_phys_segments() returns a value smaller than
the total number of bio_vecs. This leads to a slab-out-of-bounds write.

The path is reachable from userspace via the ublk driver when a server
issues a UBLK_IO_REGISTER_IO_BUF command. This requires the
UBLK_F_SUPPORT_ZERO_COPY flag which is protected by CAP_SYS_ADMIN.

Fix this by checking if the current bio_vec is physically contiguous
with the previous one. If they are contiguous, it extends the length of
the existing entry instead of writing a new one, ensuring the population
loop mirrors the segment merging done during allocation.

KASAN report:

BUG: KASAN: slab-out-of-bounds in io_buffer_register_bvec+0x813/0xb80
Write of size 8 at addr ffff88800223b238 by task kunit_try_catch/27
[...]
Call Trace:
 <TASK>
 dump_stack_lvl+0x4d/0x70
 print_report+0x151/0x4c0
 ? __pfx__raw_spin_lock_irqsave+0x10/0x10
 ? io_buffer_register_bvec+0x813/0xb80
 kasan_report+0xec/0x120
 ? io_buffer_register_bvec+0x813/0xb80
 io_buffer_register_bvec+0x813/0xb80
 io_buffer_register_bvec_overflow_test+0x4e6/0x9b0
 ? __pfx_io_buffer_register_bvec_overflow_test+0x10/0x10
 ? __pfx_pick_next_task_fair+0x10/0x10
 ? _raw_spin_lock+0x7e/0xd0
 ? finish_task_switch.isra.0+0x19a/0x650
 ? __pfx_read_tsc+0x10/0x10
 ? ktime_get_ts64+0x79/0x240
 kunit_try_run_case+0x19b/0x2c0
 ? __pfx_kunit_try_run_case+0x10/0x10
 ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
 kunit_generic_run_threadfn_adapter+0x80/0xf0
 kthread+0x323/0x670
 ? __pfx_kthread+0x10/0x10
 ? __pfx__raw_spin_lock_irq+0x10/0x10
 ? __pfx_kthread+0x10/0x10
 ret_from_fork+0x329/0x420
 ? __pfx_ret_from_fork+0x10/0x10
 ? __switch_to+0xa0f/0xd40
 ? __pfx_kthread+0x10/0x10
 ret_from_fork_asm+0x1a/0x30
 </TASK>

Fixes: 27cb27b6d5ea ("io_uring: add support for kernel registered bvecs")
Signed-off-by: Evan Lambert <veyga@veygax.dev>
---
Fixed the typos helpfully spotted by Caleb + added a new approach where
we check if the current bio_vec is physically contiguous with the
previous one. This stops the OOB write from occuring via my KUnit test.

 io_uring/rsrc.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c
index a63474b331bf..16259b75f363 100644
--- a/io_uring/rsrc.c
+++ b/io_uring/rsrc.c
@@ -988,8 +988,20 @@ int io_buffer_register_bvec(struct io_uring_cmd *cmd, struct request *rq,
 	imu->is_kbuf = true;
 	imu->dir = 1 << rq_data_dir(rq);
 
-	rq_for_each_bvec(bv, rq, rq_iter)
+	nr_bvecs = 0;
+	rq_for_each_bvec(bv, rq, rq_iter) {
+		if (nr_bvecs > 0) {
+			struct bio_vec *p = &imu->bvec[nr_bvecs - 1];
+
+			if (page_to_phys(p->bv_page) + p->bv_offset + p->bv_len ==
+			    page_to_phys(bv.bv_page) + bv.bv_offset &&
+			    p->bv_len + bv.bv_len >= p->bv_len) {
+				p->bv_len += bv.bv_len;
+				continue;
+			}
+		}
 		imu->bvec[nr_bvecs++] = bv;
+	}
 	imu->nr_bvecs = nr_bvecs;
 
 	node->buf = imu;
-- 
2.52.0

Re: [PATCH v2] io_uring/rsrc: fix slab-out-of-bounds in io_buffer_register_bvec

[Caleb Sander Mateos]

On Wed, Dec 17, 2025 at 1:50 PM veygax <veyga@veygax.dev> wrote:
>
> From: Evan Lambert <veyga@veygax.dev>
>
> The function io_buffer_register_bvec() calculates the allocation size
> for the io_mapped_ubuf based on blk_rq_nr_phys_segments(rq). This
> function calculates the number of scatter-gather elements after merging
> physically contiguous pages.
>
> However, the subsequent loop uses rq_for_each_bvec() to populate the
> array, which iterates over every individual bio_vec in the request,
> regardless of physical contiguity.
>
> If a request has multiple bio_vec entries that are physically
> contiguous, blk_rq_nr_phys_segments() returns a value smaller than
> the total number of bio_vecs. This leads to a slab-out-of-bounds write.

It's still not clear to me that a real block layer request can contain
physically contiguous bvecs. How is the request being generated in
your KUnit test that hits this issue?

>
> The path is reachable from userspace via the ublk driver when a server
> issues a UBLK_IO_REGISTER_IO_BUF command. This requires the
> UBLK_F_SUPPORT_ZERO_COPY flag which is protected by CAP_SYS_ADMIN.
>
> Fix this by checking if the current bio_vec is physically contiguous
> with the previous one. If they are contiguous, it extends the length of
> the existing entry instead of writing a new one, ensuring the population
> loop mirrors the segment merging done during allocation.
>
> KASAN report:
>
> BUG: KASAN: slab-out-of-bounds in io_buffer_register_bvec+0x813/0xb80
> Write of size 8 at addr ffff88800223b238 by task kunit_try_catch/27
> [...]
> Call Trace:
>  <TASK>
>  dump_stack_lvl+0x4d/0x70
>  print_report+0x151/0x4c0
>  ? __pfx__raw_spin_lock_irqsave+0x10/0x10
>  ? io_buffer_register_bvec+0x813/0xb80
>  kasan_report+0xec/0x120
>  ? io_buffer_register_bvec+0x813/0xb80
>  io_buffer_register_bvec+0x813/0xb80
>  io_buffer_register_bvec_overflow_test+0x4e6/0x9b0
>  ? __pfx_io_buffer_register_bvec_overflow_test+0x10/0x10
>  ? __pfx_pick_next_task_fair+0x10/0x10
>  ? _raw_spin_lock+0x7e/0xd0
>  ? finish_task_switch.isra.0+0x19a/0x650
>  ? __pfx_read_tsc+0x10/0x10
>  ? ktime_get_ts64+0x79/0x240
>  kunit_try_run_case+0x19b/0x2c0
>  ? __pfx_kunit_try_run_case+0x10/0x10
>  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
>  kunit_generic_run_threadfn_adapter+0x80/0xf0
>  kthread+0x323/0x670
>  ? __pfx_kthread+0x10/0x10
>  ? __pfx__raw_spin_lock_irq+0x10/0x10
>  ? __pfx_kthread+0x10/0x10
>  ret_from_fork+0x329/0x420
>  ? __pfx_ret_from_fork+0x10/0x10
>  ? __switch_to+0xa0f/0xd40
>  ? __pfx_kthread+0x10/0x10
>  ret_from_fork_asm+0x1a/0x30
>  </TASK>
>
> Fixes: 27cb27b6d5ea ("io_uring: add support for kernel registered bvecs")
> Signed-off-by: Evan Lambert <veyga@veygax.dev>
> ---
> Fixed the typos helpfully spotted by Caleb + added a new approach where
> we check if the current bio_vec is physically contiguous with the
> previous one. This stops the OOB write from occuring via my KUnit test.
>
>  io_uring/rsrc.c | 14 +++++++++++++-
>  1 file changed, 13 insertions(+), 1 deletion(-)
>
> diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c
> index a63474b331bf..16259b75f363 100644
> --- a/io_uring/rsrc.c
> +++ b/io_uring/rsrc.c
> @@ -988,8 +988,20 @@ int io_buffer_register_bvec(struct io_uring_cmd *cmd, struct request *rq,
>         imu->is_kbuf = true;
>         imu->dir = 1 << rq_data_dir(rq);
>
> -       rq_for_each_bvec(bv, rq, rq_iter)
> +       nr_bvecs = 0;
> +       rq_for_each_bvec(bv, rq, rq_iter) {
> +               if (nr_bvecs > 0) {
> +                       struct bio_vec *p = &imu->bvec[nr_bvecs - 1];
> +
> +                       if (page_to_phys(p->bv_page) + p->bv_offset + p->bv_len ==
> +                           page_to_phys(bv.bv_page) + bv.bv_offset &&
> +                           p->bv_len + bv.bv_len >= p->bv_len) {
> +                               p->bv_len += bv.bv_len;
> +                               continue;
> +                       }
> +               }
>                 imu->bvec[nr_bvecs++] = bv;
> +       }
>         imu->nr_bvecs = nr_bvecs;
>
>         node->buf = imu;
> --
> 2.52.0
>
>