On 7/30/20 1:21 PM, syzbot wrote: > Hello, > > syzbot found the following issue on: > > HEAD commit: 04b45717 Add linux-next specific files for 20200729 > git tree: linux-next > console output: https://syzkaller.appspot.com/x/log.txt?x=173774b8900000 > kernel config: https://syzkaller.appspot.com/x/.config?x=ec68f65b459f1ed > dashboard link: https://syzkaller.appspot.com/bug?extid=9d46305e76057f30c74e > compiler: gcc (GCC) 10.1.0-syz 20200507 > > Unfortunately, I don't have any reproducer for this issue yet. > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > Reported-by: syzbot+9d46305e76057f30c74e@xxxxxxxxxxxxxxxxxxxxxxxxx > > ================================================================== > BUG: KASAN: use-after-free in io_account_mem fs/io_uring.c:7397 [inline] > BUG: KASAN: use-after-free in io_uring_create fs/io_uring.c:8369 [inline] > BUG: KASAN: use-after-free in io_uring_setup+0x2797/0x2910 fs/io_uring.c:8400 > Read of size 1 at addr ffff888087a41044 by task syz-executor.5/18145 Quick guess would be that the ring is closed in a race before we do the accounting. The below should fix that, by ensuring that we account the memory before we install the fd. diff --git a/fs/io_uring.c b/fs/io_uring.c index fabf0b692384..eb99994de5e2 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -8329,6 +8329,11 @@ static int io_uring_create(unsigned entries, struct io_uring_params *p, ret = -EFAULT; goto err; } + + io_account_mem(ctx, ring_pages(p->sq_entries, p->cq_entries), + ACCT_LOCKED); + ctx->limit_mem = limit_mem; + /* * Install ring fd as the very last thing, so we don't risk someone * having closed it before we finish setup @@ -8338,9 +8343,6 @@ static int io_uring_create(unsigned entries, struct io_uring_params *p, goto err; trace_io_uring_create(ret, ctx, p->sq_entries, p->cq_entries, p->flags); - io_account_mem(ctx, ring_pages(p->sq_entries, p->cq_entries), - ACCT_LOCKED); - ctx->limit_mem = limit_mem; return ret; err: io_ring_ctx_wait_and_kill(ctx); -- Jens Axboe
