Re: [PATCH] io_uring: fix null-ptr-deref in io_uring_poll

[Jens Axboe <axboe@kernel.dk>]

On 4/9/26 9:28 AM, Jens Axboe wrote:
> On 4/9/26 8:55 AM, l1zao@zju.edu.cn wrote:
>> From: Haocheng Yu <l1zao@zju.edu.cn>
>>
>> A general protection fault in io_uring_poll is reported by a
>> modified Syzkaller-based kernel fuzzing tool we developed. The
>> crash occurs due to KASAN: null-ptr-deref.
>>
>> This issue is likely caused by a race condition between 
>> `io_uring_register` and `poll`. Specifically, in 
>> io_uring/register.c/io_register_resize_rings(), ctx->rings is 
>> set to NULL. Although this step is protected by a mutex lock 
>> and a spin lock, io_uring/io_uring.c/io_uring_poll() calls 
>> io_sqring_full and __io_cqring_events_user without holding the 
>> lock, in which ctx->rings is accessed.
>>
>> To fix this vulnerability, I moved the two function calls in
>> io_uring_poll() that might access ctx->rings under the protection
>> of spin_lock(&ctx->completion_lock).
> 
> Fixed a month ago, what tree are you running?
> 
>  commit 96189080265e6bb5dde3a4afbaf947af493e3f82
> Author: Jens Axboe <axboe@kernel.dk>
> Date:   Mon Mar 9 14:21:37 2026 -0600
> 
>     io_uring: ensure ctx->rings is stable for task work flags manipulation

Actually the poll part is this one:

commit 61a11cf4812726aceaee17c96432e1c08f6ed6cb
Author: Jens Axboe <axboe@kernel.dk>
Date:   Tue Mar 31 07:07:47 2026 -0600

    io_uring: protect remaining lockless ctx->rings accesses with RCU

which is also upstream.

-- 
Jens Axboe