Re: [PATCH] io_uring/rsrc: fix null-ptr-deref in io_file_bitmap_get()

[Jens Axboe <axboe@kernel.dk>]

On 3/21/23 1:44 PM, Savino Dicanosa wrote:
> When fixed files are unregistered, file_alloc_end and alloc_hint
> are not cleared. This can later cause a NULL pointer dereference in
> io_file_bitmap_get() if auto index selection is enabled via
> IORING_FILE_INDEX_ALLOC:
> 
> [    6.519129] BUG: kernel NULL pointer dereference, address: 0000000000000000
> [...]
> [    6.541468] RIP: 0010:_find_next_zero_bit+0x1a/0x70
> [...]
> [    6.560906] Call Trace:
> [    6.561322]  <TASK>
> [    6.561672]  io_file_bitmap_get+0x38/0x60
> [    6.562281]  io_fixed_fd_install+0x63/0xb0
> [    6.562851]  ? __pfx_io_socket+0x10/0x10
> [    6.563396]  io_socket+0x93/0xf0
> [    6.563855]  ? __pfx_io_socket+0x10/0x10
> [    6.564411]  io_issue_sqe+0x5b/0x3d0
> [    6.564914]  io_submit_sqes+0x1de/0x650
> [    6.565452]  __do_sys_io_uring_enter+0x4fc/0xb20
> [    6.566083]  ? __do_sys_io_uring_register+0x11e/0xd80
> [    6.566779]  do_syscall_64+0x3c/0x90
> [    6.567247]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
> [...]
> 
> To fix the issue, set file alloc range and alloc_hint to zero after
> file tables are freed.
> 
> Fixes: 4278a0deb1f6 ("io_uring: defer alloc_hint update to io_file_bitmap_set()")
> Signed-off-by: Savino Dicanosa <sd7.dev@pm.me>
> ---
>  io_uring/rsrc.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c
> index e2bac9f89902..7a43aed8e395 100644
> --- a/io_uring/rsrc.c
> +++ b/io_uring/rsrc.c
> @@ -794,6 +794,7 @@ void __io_sqe_files_unregister(struct io_ring_ctx *ctx)
>  	}
>  #endif
>  	io_free_file_tables(&ctx->file_table);
> +	io_file_table_set_alloc_range(ctx, 0, 0);
>  	io_rsrc_data_free(ctx->file_data);
>  	ctx->file_data = NULL;
>  	ctx->nr_user_files = 0;

That looks good. Do you happen to have a test case as well? Would be nice
to add that to the liburing regression tests.

-- 
Jens Axboe