From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f179.google.com (mail-pl1-f179.google.com [209.85.214.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6C2EA3B9604 for ; Mon, 6 Jul 2026 17:46:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.179 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783359996; cv=none; b=awAk0kA7ph6m03gydT0vz6FXLVjUJ5BoocLWomsUVI3KOf0upwE5ud8q6frlXFtATm75gzlIr2iooNQrRLXCda77dPohaGt5TpoESxvUDAgoRGbq3pxVydjHLA5EPx7m1fa/tU90DdqVvsgjRb7vH/52FG8XWCUUeoxUc49h2pI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783359996; c=relaxed/simple; bh=Dnp9YGDXKwdEom/HDVm38NXpfaVPjJSRKqwsi2+SVbk=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=hi2Y50iEnt66Ht5tZor+2JSs2iQs2hdAIJN9TqcZYC85tAOmMu/R1uYJmjY/98qEvyiWlkZcxwyx2Vp2Wz4S9Vs1YSpnHnM4JVvJPtzRnJnpLMwljXY1zHouWlEa/DpT2/fSX6McgsmL9KJO55Jr8vWubV3FJabYTkCgsn8rcmQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=BZAtzp+i; arc=none smtp.client-ip=209.85.214.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="BZAtzp+i" Received: by mail-pl1-f179.google.com with SMTP id d9443c01a7336-2cc7e86e7aeso18413175ad.2 for ; Mon, 06 Jul 2026 10:46:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783359995; x=1783964795; darn=vger.kernel.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=g/jwzTq7dHlHr8Ep6V1gbFVGPihF9p9J5knAlWs/rbg=; b=BZAtzp+ihr620TBilUF0b++d4MVwj1UJuHbXdCtsBj7v0aq4qjSp83COwEiAW/aqJl TSurMuoS815vWfL1GegZYtxb2LkxQoYiN2FIo0mp29yPSDDGP4tazCzUvgaWR0eoPpT6 5FlhvC2kaOfdQjWEXenN6zhKW8NuReFSe5Y7xJdOwRYkt6AnHS03YSnUMKz8uVyxR4tz pvDTnAQ7GessHttCHCqgj2tI9X3qCVo9kq+nbzEUYQpTVa7w17VHBDXFplmB94ujVERu SWtaa6tnqAMmPhpoGI31haGlI1cyahWRKdYMBmOYMYcImC8+Aqk5ONEjJCl24MjV9uq1 dSPQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783359995; x=1783964795; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=g/jwzTq7dHlHr8Ep6V1gbFVGPihF9p9J5knAlWs/rbg=; b=BdNdDw4egE0GaxYh3xcr3xc/s7Qihe/WfWAQmMHr3N2Juf0PZykOz3PfVbmkpuJPfJ vl0nGIPFZmWOp+VCJeCxl+LfNY+vDvwUF80+T0xcm0hy8pqYxjacbjY4IJOwRWStVRtW piKry3dubc9cqHZWP+jZJdRuBZUhXLD+WN/DBsVu9yWcX9+43xBs/DXCgiSFeNcZX7TB VGidNHuyJCtjT9C/At1jMsxW4orRHWmKGOVrk4ZgbEdmn1FpywMG3dEja69mGLPjadHR 4v2Zv3OKCDlbixp2iewONVSYvdLVFgefTqAePvaivtQ3kD1pIcs1dCzFdncz4zispvVn ZU0w== X-Gm-Message-State: AOJu0Yw5/GPOx+hjkwNVC15C4iNuMuwt99Ml5X/tGTIN2W37vVmZeK8O ZhVB3dtd4kC0G1TOu3D0TWDtoyPscA22E/tQaFY8uhog6NkKsFyHxmDX X-Gm-Gg: AfdE7cmRuu3hh326SULV7KZwFbf7OE3QkBYx9WnsDuYKiIP9kfKYTetjHkH3iH8Ikeg RyjsxGMOERLZ9fchioFFtR+zjdZc1AdgmA5g40r8jFu/Fq4VgCbhoXQ9oYGbU+R+B86giRDL6MR MJouXQWBO3gKouyZYvvNKDm/bU+tkzpEfMZthCf1s5BgBgj3t4H770NnAqEqIcDYaGlzqtrFWB/ 5v6PlM1wXHn8LWH9WD44uXhEZPs//8HaCulo3jbHmO8xdejCqOFV2hKIKafChKf9OiW86hPxGiD Y6CUK32PZ+mSrtPC3eaSCG0MzdStrM+bdREj1XQvmpUiRBC4fysJAymjpGSJooQ0Gzzv7y0DVXJ F67WaSq18uPbwAprZ5Kxx67jp+zPDDI+0wwxMvuhWwJc/PggAa+LlhMxfLRkARIqYdfZScLVvV8 rjNCIsZoBdr7IcawK0jgMDHs5RXZiYchVSIGdanj8= X-Received: by 2002:a17:902:f712:b0:2c2:62ee:5a0d with SMTP id d9443c01a7336-2ccbe61090dmr17418365ad.14.1783359994567; Mon, 06 Jul 2026 10:46:34 -0700 (PDT) Received: from naup-virtual-machine ([140.113.139.102]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2cad7893f0fsm53738555ad.75.2026.07.06.10.46.33 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 06 Jul 2026 10:46:34 -0700 (PDT) Date: Tue, 7 Jul 2026 01:46:31 +0800 From: Hao-Yu Yang To: Jens Axboe Cc: linux-kernel@vger.kernel.org, io-uring@vger.kernel.org Subject: Re: [PATCH v1] io_uring: fix dangling iovec after provided-buffer bundle grow failure Message-ID: References: <20260705234534.768138-1-naup96721@gmail.com> <0a370728-f8be-4aaa-bbc6-276376adc5ce@kernel.dk> <92f036c0-2759-417c-b912-8b6f003bc390@kernel.dk> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <92f036c0-2759-417c-b912-8b6f003bc390@kernel.dk> On Mon, Jul 06, 2026 at 11:39:14AM -0600, Jens Axboe wrote: > On 7/6/26 11:34 AM, Hao-Yu Yang wrote: > > On Mon, Jul 06, 2026 at 11:13:55AM -0600, Jens Axboe wrote: > >> On 7/6/26 11:01 AM, Hao-Yu Yang wrote: > >>> Sorry, i forgot to cc others mail > >>> > >>> I discovered and wrote the PoC myself. Trigger way is > >>> send1: Submit an IORING_OP_SEND request with four valid > >>> provided buffers. The system will allocate and cache an > >>> iovec array (of size 4) for this request and store the > >>> pointer in kmsg->vec.iovec. > >>> > >>> send2: Submit a second send request with 8, and I set > >>> the fourth passed-in address to point to an invalid address. > >>> Now kmsg still hold old iovec, but old iovec object have > >>> been freed. > >>> > >>> So this will lead dangling pointer. > >> > >> Side note: please don't top post, linux mailing lists always reply > >> under the text for better readability. Top posting turns any kind > >> of threaded conversation into both a mess, and it's also wasteful. > >> > >> Great thanks! Want to turn this into a liburing test case? Then we can > >> include it there as well, and it'd catch both UAF and memory leaks when > >> run. > >> > >> -- > >> Jens Axboe > > > > How to turn this into a liburing test case? Should this be included in > > the v2 patch? > > Look at the tests in test/ in liburing. Or just send the reproducer and > I can get it turned into a test case. > > Should be separate from a kernel patch, it's a patch for an entirely > different repository. > > > -- > Jens Axboe OK, I will send v2 patch first when i wake up. And I now my PoC to trigger this KASAN have became a exploit can use to priviledge escalation. I think i should send this script to your email? (not included any public gmail?)