linux-kernel - [PATCH] io_uring/rsrc: fix null ptr dereference in io_sqe_buffer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20241104035105.192960-1-danielyangkang@gmail.com>
Date: Sun,  3 Nov 2024 19:51:05 -0800
From: Daniel Yang <danielyangkang@...il.com>
To: Jens Axboe <axboe@...nel.dk>,
	Pavel Begunkov <asml.silence@...il.com>,
	io-uring@...r.kernel.org (open list:IO_URING),
	linux-kernel@...r.kernel.org (open list)
Cc: Daniel Yang <danielyangkang@...il.com>,
	syzbot+05c0f12a4d43d656817e@...kaller.appspotmail.com
Subject: [PATCH] io_uring/rsrc: fix null ptr dereference in io_sqe_buffer_register

The call stack io_sqe_buffer_register -> io_buffer_account_pin ->
headpage_already_acct results in a null ptr dereference in the for loop.
There is no guarantee that ctx->buf_table.nodes[i] is an allocated node
so add a check if null before dereferencing.

Signed-off-by: Daniel Yang <danielyangkang@...il.com>
Reported-by: syzbot+05c0f12a4d43d656817e@...kaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=05c0f12a4d43d656817e
Fixes: 661768085e99 ("io_uring/rsrc: get rid of the empty node and dummy_ubuf")
---
 io_uring/rsrc.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c
index af60d9f59..e2edb752a 100644
--- a/io_uring/rsrc.c
+++ b/io_uring/rsrc.c
@@ -581,6 +581,8 @@ static bool headpage_already_acct(struct io_ring_ctx *ctx, struct page **pages,
 	/* check previously registered pages */
 	for (i = 0; i < ctx->buf_table.nr; i++) {
 		struct io_rsrc_node *node = ctx->buf_table.nodes[i];
+		if (!node)
+			continue;
 		struct io_mapped_ubuf *imu = node->buf;
 
 		for (j = 0; j < imu->nr_bvecs; j++) {
-- 
2.39.2