[PATCH] io_uring/kbuf: fix UAF in buffer selection when access_ok fails on expanded iovec

[PATCH] io_uring/kbuf: fix UAF in buffer selection when access_ok fails on expanded iovec

[Aayush7352]

From: Aayush Dixit <aayushdixit924@gmail.com>

In io_ring_buffers_peek(), when the buffer ring is expanded
(KBUF_MODE_EXPAND), arg->iovs is set to a newly kmalloced array.
If access_ok() then fails on a buffer entry, the error path kfrees
the new array but does not restore arg->iovs to the original value
(org_iovs).  arg->iovs is left dangling and will be reused on retry,
causing a use-after-free when the caller retries the buffer selection.

Fix by restoring arg->iovs = org_iovs after the kfree on the error
path, so the caller's state remains coherent on retry.

Fixes: b3e0216c97e3 ("io_uring: add buffer ring support")
Cc: io-uring@vger.kernel.org
Signed-off-by: Aayush7352 <aayushdixit924@gmail.com>
---
 io_uring/kbuf.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c
index de0129bce..eab4de8a7 100644
--- a/io_uring/kbuf.c
+++ b/io_uring/kbuf.c
@@ -314,8 +314,10 @@ static int io_ring_buffers_peek(struct io_kiocb *req, struct buf_sel_arg *arg,
 		iov->iov_base = u64_to_user_ptr(READ_ONCE(buf->addr));
 		iov->iov_len = len;
 		if (unlikely(!access_ok(iov->iov_base, len))) {
-			if (arg->iovs != org_iovs)
+			if (arg->iovs != org_iovs) {
 				kfree(arg->iovs);
+				arg->iovs = org_iovs;
+			}
 			return -EFAULT;
 		}
 		iov++;
-- 
2.55.0

Re: [PATCH] io_uring/kbuf: fix UAF in buffer selection when access_ok fails on expanded iovec

[Jens Axboe]

On 7/21/26 3:57 AM, Aayush7352 wrote:
> From: Aayush Dixit <aayushdixit924@gmail.com>
> 
> In io_ring_buffers_peek(), when the buffer ring is expanded
> (KBUF_MODE_EXPAND), arg->iovs is set to a newly kmalloced array.
> If access_ok() then fails on a buffer entry, the error path kfrees
> the new array but does not restore arg->iovs to the original value
> (org_iovs).  arg->iovs is left dangling and will be reused on retry,
> causing a use-after-free when the caller retries the buffer selection.
> 
> Fix by restoring arg->iovs = org_iovs after the kfree on the error
> path, so the caller's state remains coherent on retry.

You sent this twice, replying once for both: this is bogus. If your
LLM thinks it found something, have it write a reproducer. Then YOU
reproduce, and then you can report it. Don't waste our time with
garbage like this.

> Fixes: b3e0216c97e3 ("io_uring: add buffer ring support")

This is also bogus, this sha doesn't exist.

-- 
Jens Axboe

[PATCH] io_uring/kbuf: fix UAF in buffer selection when access_ok fails on expanded iovec

[Aayush7352]

In io_ring_buffers_peek(), when the buffer ring is expanded
(KBUF_MODE_EXPAND), arg->iovs is set to a newly kmalloced array.
If access_ok() then fails on a buffer entry, the error path kfrees
the new array but does not restore arg->iovs to the original value
(org_iovs).  arg->iovs is left dangling and will be reused on retry,
causing a use-after-free when the caller retries the buffer selection.

Fix by restoring arg->iovs = org_iovs after the kfree on the error
path, so the caller's state remains coherent on retry.

Fixes: b3e0216c97e3 ("io_uring: add buffer ring support")
Cc: io-uring@vger.kernel.org
Signed-off-by: Aayush7352 <aayushdixit924@gmail.com>
---
 io_uring/kbuf.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c
index de0129bce..eab4de8a7 100644
--- a/io_uring/kbuf.c
+++ b/io_uring/kbuf.c
@@ -314,8 +314,10 @@ static int io_ring_buffers_peek(struct io_kiocb *req, struct buf_sel_arg *arg,
 		iov->iov_base = u64_to_user_ptr(READ_ONCE(buf->addr));
 		iov->iov_len = len;
 		if (unlikely(!access_ok(iov->iov_base, len))) {
-			if (arg->iovs != org_iovs)
+			if (arg->iovs != org_iovs) {
 				kfree(arg->iovs);
+				arg->iovs = org_iovs;
+			}
 			return -EFAULT;
 		}
 		iov++;
-- 
2.55.0