Re: KASAN: use-after-free Read in tctx_task_work

[Jens Axboe <axboe@kernel.dk>]

On 2/28/21 2:59 AM, syzbot wrote:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    29c395c7 Merge tag 'x86-entry-2021-02-24' of git://git.ker..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=11cd05cad00000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=c581c545cb4ffac7
> dashboard link: https://syzkaller.appspot.com/bug?extid=a157ac7c03a56397f553
> compiler:       Debian clang version 11.0.1-2
> 
> Unfortunately, I don't have any reproducer for this issue yet.
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+a157ac7c03a56397f553@syzkaller.appspotmail.com
> 
> ==================================================================
> BUG: KASAN: use-after-free in __tctx_task_work fs/io_uring.c:2217 [inline]
> BUG: KASAN: use-after-free in tctx_task_work+0x238/0x280 fs/io_uring.c:2230
> Read of size 4 at addr ffff88802178e3f0 by task syz-executor.2/12656

This should fix it.


commit adc34362605c08e622c0750ae3377ed03637abd1
Author: Jens Axboe <axboe@kernel.dk>
Date:   Sun Feb 28 09:59:26 2021 -0700

    io_uring: don't attempt to re-flush completions
    
    If 'node' is NULL, there are no more completions to flush after doing
    this round. And since the req flushing will put ctx references, it's
    quite possible that the ctx is gone after the flush. Don't dereference
    it unless we know we have more to flush.
    
    Fixes: 65453d1efbd2 ("io_uring: enable req cache for task_work items")
    Reported-by: syzbot+a157ac7c03a56397f553@syzkaller.appspotmail.com
    Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 87e8e40b566e..9db79d4b0827 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -1829,7 +1829,7 @@ static bool __tctx_task_work(struct io_uring_task *tctx)
 			mutex_lock(&ctx->uring_lock);
 			io_submit_flush_completions(&ctx->submit_state.comp, ctx);
 			mutex_unlock(&ctx->uring_lock);
-			ctx = this_ctx;
+			ctx = node ? this_ctx : NULL;
 		}
 	}
 

-- 
Jens Axboe