• Savino Dicanosa's avatar
    io_uring/rsrc: fix null-ptr-deref in io_file_bitmap_get() · 02a4d923
    Savino Dicanosa authored
    When fixed files are unregistered, file_alloc_end and alloc_hint
    are not cleared. This can later cause a NULL pointer dereference in
    io_file_bitmap_get() if auto index selection is enabled via
    IORING_FILE_INDEX_ALLOC:
    
    [    6.519129] BUG: kernel NULL pointer dereference, address: 0000000000000000
    [...]
    [    6.541468] RIP: 0010:_find_next_zero_bit+0x1a/0x70
    [...]
    [    6.560906] Call Trace:
    [    6.561322]  <TASK>
    [    6.561672]  io_file_bitmap_get+0x38/0x60
    [    6.562281]  io_fixed_fd_install+0x63/0xb0
    [    6.562851]  ? __pfx_io_socket+0x10/0x10
    [    6.563396]  io_socket+0x93/0xf0
    [    6.563855]  ? __pfx_io_socket+0x10/0x10
    [    6.564411]  io_issue_sqe+0x5b/0x3d0
    [    6.564914]  io_submit_sqes+0x1de/0x650
    [    6.565452]  __do_sys_io_uring_enter+0x4fc/0xb20
    [    6.566083]  ? __do_sys_io_uring_register+0x11e/0xd80
    [    6.566779]  do_syscall_64+0x3c/0x90
    [    6.567247]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
    [...]
    
    To fix the issue, set file alloc range and alloc_hint to zero after
    file tables are freed.
    
    Cc: stable@vger.kernel.org
    Fixes: 4278a0de ("io_uring: defer alloc_hint update to io_file_bitmap_set()")
    Signed-off-by: default avatarSavino Dicanosa <sd7.dev@pm.me>
    [axboe: add explicit bitmap == NULL check as well]
    Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
    02a4d923
rsrc.c 32.6 KB