On 12/12/24 4:21 AM, Pavel Begunkov wrote: > On 12/12/24 10:08, chase xd wrote: >> Syzkaller hit 'KASAN: use-after-free Read in io_cqring_wait' bug. >> >> ================================================================== >> BUG: KASAN: use-after-free in io_cqring_wait+0x16bc/0x1780 >> io_uring/io_uring.c:2630 >> Read of size 4 at addr ffff88807d128008 by task syz-executor994/8389 > > So kernel reads CQ head/tail and get a UAF. The ring was allocated > while resizing rings and was also deleted while resizing rings, but > those could be different resize attempts. I suspect this report would be fixed by just doing: return READ_ONCE(ctx->rings->cq.head) == READ_ONCE(ctx->rings->cq.tail) ? ret : 0; as ->rings can have changed since we entered the function. But that obviously won't fully sort this out, let me ponder it for a bit... > Jens, considering the lack of locking on the normal waiting path, > while swapping rings what prevents waiters from seeing an old ring? > I'd assume that's the problem at hand. Yep exactly. -- Jens Axboe
