Savino Dicanosa 7b100a45dc io_uring/rsrc: fix null-ptr-deref in io_file_bitmap_get() ... commit 02a4d923e4 upstream. When fixed files are unregistered, file_alloc_end and alloc_hint are not cleared. This can later cause a NULL pointer dereference in io_file_bitmap_get() if auto index selection is enabled via IORING_FILE_INDEX_ALLOC: [ 6.519129] BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] [ 6.541468] RIP: 0010:_find_next_zero_bit+0x1a/0x70 [...] [ 6.560906] Call Trace: [ 6.561322] <TASK> [ 6.561672] io_file_bitmap_get+0x38/0x60 [ 6.562281] io_fixed_fd_install+0x63/0xb0 [ 6.562851] ? __pfx_io_socket+0x10/0x10 [ 6.563396] io_socket+0x93/0xf0 [ 6.563855] ? __pfx_io_socket+0x10/0x10 [ 6.564411] io_issue_sqe+0x5b/0x3d0 [ 6.564914] io_submit_sqes+0x1de/0x650 [ 6.565452] __do_sys_io_uring_enter+0x4fc/0xb20 [ 6.566083] ? __do_sys_io_uring_register+0x11e/0xd80 [ 6.566779] do_syscall_64+0x3c/0x90 [ 6.567247] entry_SYSCALL_64_after_hwframe+0x72/0xdc [...] To fix the issue, set file alloc range and alloc_hint to zero after file tables are freed. Cc: stable@vger.kernel.org Fixes: 4278a0deb1 ("io_uring: defer alloc_hint update to io_file_bitmap_set()") Signed-off-by: Savino Dicanosa <sd7.dev@pm.me> [axboe: add explicit bitmap == NULL check as well] Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2023-03-30 12:49:25 +02:00
..
advise.c	io_uring: make io_kiocb_to_cmd() typesafe	2022-08-12 17:01:00 -06:00
advise.h
alloc_cache.h
cancel.c	io_uring/cancel: re-grab ctx mutex after finishing wait	2023-01-12 12:02:38 +01:00
cancel.h
epoll.c	io_uring: make io_kiocb_to_cmd() typesafe	2022-08-12 17:01:00 -06:00
epoll.h
fdinfo.c	io_uring/fdinfo: include locked hash table in fdinfo output	2023-01-18 11:58:15 +01:00
fdinfo.h
filetable.c	io_uring/rsrc: fix null-ptr-deref in io_file_bitmap_get()	2023-03-30 12:49:25 +02:00
filetable.h	io_uring: kill hot path fixed file bitmap debug checks	2022-10-16 17:07:53 -06:00
fs.c	io_uring: make io_kiocb_to_cmd() typesafe	2022-08-12 17:01:00 -06:00
fs.h
io-wq.c	io_uring/io-wq: only free worker if it was allocated for creation	2023-01-18 11:58:33 +01:00
io-wq.h
io_uring.c	io_uring: fix fget leak when fs don't support nowait buffered read	2023-03-10 09:34:04 +01:00
io_uring.h	io_uring: mark task TASK_RUNNING before handling resume/task work	2023-03-10 09:34:07 +01:00
kbuf.c	io_uring: fix size calculation when registering buf ring	2023-03-11 13:55:30 +01:00
kbuf.h	io_uring: allow buffer recycling in READV	2022-09-21 10:30:43 -06:00
Makefile
msg_ring.c	io_uring/msg_ring: let target know allocated index	2023-03-22 13:34:06 +01:00
msg_ring.h
net.c	io_uring/net: avoid sending -ECONNABORTED on repeated connection requests	2023-03-30 12:49:25 +02:00
net.h	io_uring/net: zerocopy sendmsg	2022-09-21 13:15:02 -06:00
nop.c
nop.h
notif.c	io_uring/net: introduce IORING_SEND_ZC_REPORT_USAGE flag	2022-12-31 13:33:11 +01:00
notif.h	io_uring/net: introduce IORING_SEND_ZC_REPORT_USAGE flag	2022-12-31 13:33:11 +01:00
opdef.c	io_uring: dont remove file from msg_ring reqs	2022-12-31 13:33:12 +01:00
opdef.h	io_uring: dont remove file from msg_ring reqs	2022-12-31 13:33:12 +01:00
openclose.c	io_uring: make io_kiocb_to_cmd() typesafe	2022-08-12 17:01:00 -06:00
openclose.h
poll.c	io_uring/poll: allow some retries for poll triggering spuriously	2023-03-11 13:55:43 +01:00
poll.h	io_uring/poll: allow some retries for poll triggering spuriously	2023-03-11 13:55:43 +01:00
refs.h
rsrc.c	io_uring/rsrc: fix null-ptr-deref in io_file_bitmap_get()	2023-03-30 12:49:25 +02:00
rsrc.h	io_uring: remove FFS_SCM	2022-10-16 17:07:12 -06:00
rw.c	use less confusing names for iov_iter direction initializers	2023-02-09 11:28:04 +01:00
rw.h	io_uring/rw: don't lose partial IO result on fail	2022-09-21 13:15:02 -06:00
slist.h
splice.c	io_uring: make io_kiocb_to_cmd() typesafe	2022-08-12 17:01:00 -06:00
splice.h
sqpoll.c
sqpoll.h
statx.c	io_uring: make io_kiocb_to_cmd() typesafe	2022-08-12 17:01:00 -06:00
statx.h
sync.c	io_uring: make io_kiocb_to_cmd() typesafe	2022-08-12 17:01:00 -06:00
sync.h
tctx.c	io_uring: remove io_register_submitter	2022-10-07 12:25:30 -06:00
tctx.h	io_uring: simplify __io_uring_add_tctx_node	2022-10-07 12:25:30 -06:00
timeout.c	io_uring: remove io_req_tw_post_queue	2023-02-01 08:34:41 +01:00
timeout.h	io_uring: remove unused return from io_disarm_next	2022-09-21 13:15:01 -06:00
uring_cmd.c	io_uring/uring_cmd: ensure that device supports IOPOLL	2023-03-17 08:50:14 +01:00
uring_cmd.h
xattr.c	__io_setxattr(): constify path	2022-09-01 17:39:05 -04:00
xattr.h