[PATCH] io_uring/kbuf: fix UAF in buffer selection when access_ok fails on expanded iovec

[Aayush7352 <aayushdixit924@gmail.com>]

In io_ring_buffers_peek(), when the buffer ring is expanded
(KBUF_MODE_EXPAND), arg->iovs is set to a newly kmalloced array.
If access_ok() then fails on a buffer entry, the error path kfrees
the new array but does not restore arg->iovs to the original value
(org_iovs).  arg->iovs is left dangling and will be reused on retry,
causing a use-after-free when the caller retries the buffer selection.

Fix by restoring arg->iovs = org_iovs after the kfree on the error
path, so the caller's state remains coherent on retry.

Fixes: b3e0216c97e3 ("io_uring: add buffer ring support")
Cc: io-uring@vger.kernel.org
Signed-off-by: Aayush7352 <aayushdixit924@gmail.com>
---
 io_uring/kbuf.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c
index de0129bce..eab4de8a7 100644
--- a/io_uring/kbuf.c
+++ b/io_uring/kbuf.c
@@ -314,8 +314,10 @@ static int io_ring_buffers_peek(struct io_kiocb *req, struct buf_sel_arg *arg,
 		iov->iov_base = u64_to_user_ptr(READ_ONCE(buf->addr));
 		iov->iov_len = len;
 		if (unlikely(!access_ok(iov->iov_base, len))) {
-			if (arg->iovs != org_iovs)
+			if (arg->iovs != org_iovs) {
 				kfree(arg->iovs);
+				arg->iovs = org_iovs;
+			}
 			return -EFAULT;
 		}
 		iov++;
-- 
2.55.0