io_uring: fix dangling iovec after provided-buffer bundle grow failure

When growing a provided-buffer bundle, the old cached iovec is freed
before the new buffers have all been validated. If validation fails, the
request still points at the freed iovec, which can be freed again during
completion cleanup.

Fix this by deferring the free of the old cached iovec until validation
has succeeded. On failure, free the newly allocated iovec and leave the
request pointing at the original one.

Fixes: 46800585ae04 ("io_uring/kbuf: validate ring provided buffer addresses with access_ok()")
Signed-off-by: Hao-Yu Yang <naup96721@gmail.com>
Link: https://patch.msgid.link/20260706183304.919275-1-naup96721@gmail.com
Suggested-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c
index 3cd29477fff2d3e35d7024b8a8905cc177fd36f0..b6b969b55e12241c6998549a72e7c5e454ac35e6 100644 (file)
--- a/io_uring/kbuf.c
+++ b/io_uring/kbuf.c
@@ -287,8 +287,6 @@ static int io_ring_buffers_peek(struct io_kiocb *req, struct buf_sel_arg *arg,
                iov = kmalloc_objs(struct iovec, nr_avail);
                if (unlikely(!iov))
                        return -ENOMEM;
-               if (arg->mode & KBUF_MODE_FREE)
-                       kfree(arg->iovs);
                arg->iovs = iov;
                nr_iovs = nr_avail;
        } else if (nr_avail < nr_iovs) {
@@ -330,6 +328,9 @@ static int io_ring_buffers_peek(struct io_kiocb *req, struct buf_sel_arg *arg,
                buf = io_ring_head_to_buf(br, ++head, bl->mask);
        } while (--nr_iovs);
 
+       if (arg->mode & KBUF_MODE_FREE)
+               kfree(arg->iovs);
+
        if (head == tail)
                req->flags |= REQ_F_BL_EMPTY;