On Tue, 21 Mar 2023 19:44:02 +0000, Savino Dicanosa wrote:
> When fixed files are unregistered, file_alloc_end and alloc_hint
> are not cleared. This can later cause a NULL pointer dereference in
> io_file_bitmap_get() if auto index selection is enabled via
> IORING_FILE_INDEX_ALLOC:
>
> [ 6.519129] BUG: kernel NULL pointer dereference, address: 0000000000000000
> [...]
> [ 6.541468] RIP: 0010:_find_next_zero_bit+0x1a/0x70
> [...]
> [ 6.560906] Call Trace:
> [ 6.561322] <TASK>
> [ 6.561672] io_file_bitmap_get+0x38/0x60
> [ 6.562281] io_fixed_fd_install+0x63/0xb0
> [ 6.562851] ? __pfx_io_socket+0x10/0x10
> [ 6.563396] io_socket+0x93/0xf0
> [ 6.563855] ? __pfx_io_socket+0x10/0x10
> [ 6.564411] io_issue_sqe+0x5b/0x3d0
> [ 6.564914] io_submit_sqes+0x1de/0x650
> [ 6.565452] __do_sys_io_uring_enter+0x4fc/0xb20
> [ 6.566083] ? __do_sys_io_uring_register+0x11e/0xd80
> [ 6.566779] do_syscall_64+0x3c/0x90
> [ 6.567247] entry_SYSCALL_64_after_hwframe+0x72/0xdc
> [...]
>
> [...]
Applied, thanks!
[1/1] io_uring/rsrc: fix null-ptr-deref in io_file_bitmap_get()
commit: 761efd55a0227aca3a69deacdaa112fffd44fe37
Best regards,
--
Jens Axboe
