Re: [PATCH] io_uring/kbuf: fix use-after-free of new iovec on bundle grow

On Tue, Jul 14, 2026 at 10:01:28AM -0400, Gabriel Krisman Bertazi wrote:
> Breno Leitao <[email protected]> writes:
> 
> > When io_ring_buffers_peek() grows a provided-buffer bundle, it allocates
> > a new iovec array and points arg->iovs at it. The KBUF_MODE_FREE cleanup
> > added at the end of the function then does kfree(arg->iovs), which frees
> > this freshly allocated array that is about to be returned to and used by
> > the caller, instead of the old cached iovec (org_iovs) it was meant to
> > release. The caller reads the now-freed array, resulting in a
> > use-after-free, easily triggered by the liburing recv-bundle-short-ooo
> > test:
> >
> >   BUG: KASAN: slab-use-after-free in io_recv+0x4bc/0xc60
> >   Read of size 8 at addr ffff00037b20c240 by task recv-bundle-sho
> >    io_recv
> >   Allocated by task:
> >    __kmalloc_noprof
> >    io_ring_buffers_peek
> >    io_buffers_peek
> >    io_recv
> >   Freed by task:
> >    kfree
> >    io_ring_buffers_peek
> >    io_buffers_peek
> >    io_recv
> >
> > Free org_iovs instead, and only when it was actually replaced by a new
> > allocation. On the access_ok() failure path the new array is already
> > freed and the request is left pointing at the original iovec, so nothing
> > needs to be released at this point in that case.
> >
> > Fixes: cd053d788c3f ("io_uring: fix dangling iovec after provided-buffer bundle grow failure")
> > Signed-off-by: Breno Leitao <[email protected]>
> 
> Already fixed here
> 
> https://lore.kernel.org/io-uring/[email protected]/T/#u
> 
> here:
> 
> https://lore.kernel.org/io-uring/OS3PR01MB8810F38D613E37FBD684DC4D83FB2@OS3PR01MB8810.jpnprd01.prod.outlook.com/T/#t
> 
> and here:
> 
> https://lore.kernel.org/io-uring/[email protected]/T/#u

Oh, -ETOOMANY fixes.

> Aren't LLMs fun?

Oh yes, It is easier to send the fix than to check in the mailing list
if someone has fixed it already.