In io_send_recvmsg(), there is no check for the req->file.
User can change the opcode from IORING_OP_NOP to IORING_OP_SENDMSG
through competition after the io_req_set_file().
This vulnerability will leak sensitive kernel information.
[352693.910110] BUG: kernel NULL pointer dereference, address: 0000000000000028
[352693.910112] #PF: supervisor read access in kernel mode
[352693.910112] #PF: error_code(0x0000) - not-present page
[352693.910113] PGD 8000000251396067 P4D 8000000251396067 PUD 1d64ba067 PMD 0
[352693.910115] Oops: 0000 [#3] SMP PTI
[352693.910116] CPU: 11 PID: 303132 Comm: test Tainted: G D
[352693.910117] Hardware name: Dell Inc. OptiPlex 3060/0T0MHW, BIOS 1.4.2 06/11/2019
[352693.910120] RIP: 0010:sock_from_file+0x9/0x30
[352693.910122] RSP: 0018:ffffc0a5084cfc50 EFLAGS: 00010246
[352693.910122] RAX: ffff9f6ee284d000 RBX: ffff9f6bd3675000 RCX: ffffffff8b111340
[352693.910123] RDX: 0000000000000001 RSI: ffffc0a5084cfc64 RDI: 0000000000000000
[352693.910124] RBP: ffffc0a5084cfc50 R08: 0000000000000000 R09: ffff9f6ee51a9200
[352693.910124] R10: ffff9f6ee284d200 R11: 0000000000000000 R12: ffff9f6ee51a9200
[352693.910125] R13: 0000000000000001 R14: ffffffff8b111340 R15: ffff9f6ee284d000
[352693.910126] FS: 00000000016d7880(0000) GS:ffff9f6eee2c0000(0000) knlGS:0000000000000000
[352693.910126] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[352693.910127] CR2: 0000000000000028 CR3: 000000041fb4a005 CR4: 00000000003626e0
[352693.910127] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[352693.910128] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[352693.910128] Call Trace:
[352693.910132] io_send_recvmsg+0x49/0x170
[352693.910134] ? __switch_to_asm+0x34/0x70
[352693.910135] __io_submit_sqe+0x45e/0x8e0
[352693.910136] ? __switch_to_asm+0x34/0x70
[352693.910137] ? __switch_to_asm+0x40/0x70
[352693.910138] ? __switch_to_asm+0x34/0x70
[352693.910138] ? __switch_to_asm+0x40/0x70
[352693.910139] ? __switch_to_asm+0x34/0x70
[352693.910140] ? __switch_to_asm+0x40/0x70
[352693.910141] ? __switch_to_asm+0x34/0x70
[352693.910142] ? __switch_to_asm+0x40/0x70
[352693.910143] ? __switch_to_asm+0x34/0x70
[352693.910144] ? __switch_to_asm+0x34/0x70
[352693.910145] __io_queue_sqe+0x23/0x230
[352693.910146] io_queue_sqe+0x7a/0x90
[352693.910148] io_submit_sqe+0x23d/0x330
[352693.910149] io_ring_submit+0xca/0x200
[352693.910150] ? do_nanosleep+0xad/0x160
[352693.910151] ? hrtimer_init_sleeper+0x2c/0x90
[352693.910152] ? hrtimer_nanosleep+0xc2/0x1a0
[352693.910154] __x64_sys_io_uring_enter+0x1e4/0x2c0
[352693.910156] do_syscall_64+0x57/0x190
[352693.910157] entry_SYSCALL_64_after_hwframe+0x44/0xa9
Signed-off-by: Liu Yong <pkfxxxing@xxxxxxxxx>
---
fs/io_uring.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/fs/io_uring.c b/fs/io_uring.c
index e0200406765c..0a26100b8260 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -1675,6 +1675,9 @@ static int io_send_recvmsg(struct io_kiocb *req, const struct io_uring_sqe *sqe,
if (unlikely(req->ctx->flags & IORING_SETUP_IOPOLL))
return -EINVAL;
+ if (!req->file)
+ return -EBADF;
+
sock = sock_from_file(req->file, &ret);
if (sock) {
struct user_msghdr __user *msg;
--
2.17.1
