Re: [PATCH v2] io_uring: fix dangling iovec after provided-buffer bundle grow failure
Jens Axboe <[email protected]> Mon, 06 Jul 2026 18:50:35 -0600
| Newsgroups | org.kernel.vger.io-uring,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <178338543579.49877.9882374687710864124.b4-ty@b4> |
On Tue, 07 Jul 2026 02:33:04 +0800, Hao-Yu Yang wrote:
> When growing a provided-buffer bundle, the old cached iovec is freed
> before the new buffers have all been validated. If validation fails, the
> request still points at the freed iovec, which can be freed again during
> completion cleanup.
>
> BUG: KASAN: double-free in io_vec_free+0x2c/0x90
> Freed by task 73:
> kfree+0x104/0x3b0
> io_vec_free+0x2c/0x90
> __io_submit_flush_completions+0xc03/0x1e40
> io_submit_sqes+0xdb5/0x2310
>
> [...]
Applied, thanks!
[1/1] io_uring: fix dangling iovec after provided-buffer bundle grow failure
commit: cd053d788c3f13b3eaf16672d427ee828fda16ed
Best regards,
--
Jens Axboe