Re: [PATCH] ext4: don't use the kiocb after a direct read was queued

[sashiko-bot@kernel.org]

> ext4_dio_read_iter() calls file_accessed(iocb->ki_filp) after it
> submitted the direct read. But once the read was queued the kiocb
> belongs to the completion handler. If the read completes before
> ext4_dio_read_iter() gets to file_accessed() and the completion handler
> frees the kiocb it reads freed memory.
> 
> aio and io_uring hold a reference to the kiocb until the submission
> returned so they don't have that problem. The fileio backend of the
> scsi target with fd_async_io=1 frees the kiocb in the completion
> handler:
> 
>   BUG: KASAN: slab-use-after-free in ext4_dio_read_iter+0x5e1/0x690
>   Workqueue: target_submission target_queued_submit_work
>   Call Trace:
>    <TASK>
> [ ... ]
> Remember the file before the read is submitted. xfs avoids the same
> problem by calling file_accessed() before it submits the read.
> 
> Fixes: b1b4705d54ab ("ext4: introduce direct I/O read using iomap infrastructure")
> Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261113-work-ext4-dio_read_kiocb-v1-1-172a88be803c@kernel.org?part=1