From: Greg Kroah-Hartman Date: Mon, 24 Mar 2025 18:51:36 +0000 (-0700) Subject: 6.12-stable patches X-Git-Tag: v6.1.132~22 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=155d4c6d2b267f95e2b3014df722b68fc51dcc64;p=thirdparty%2Fkernel%2Fstable-queue.git 6.12-stable patches added patches: io_uring-net-fix-sendzc-double-notif-flush.patch --- diff --git a/queue-6.12/io_uring-net-fix-sendzc-double-notif-flush.patch b/queue-6.12/io_uring-net-fix-sendzc-double-notif-flush.patch new file mode 100644 index 0000000000..5aceda2e49 --- /dev/null +++ b/queue-6.12/io_uring-net-fix-sendzc-double-notif-flush.patch @@ -0,0 +1,60 @@ +From 67c007d6c12da3e456c005083696c20d4498ae72 Mon Sep 17 00:00:00 2001 +From: Pavel Begunkov +Date: Sat, 22 Mar 2025 11:47:27 +0000 +Subject: io_uring/net: fix sendzc double notif flush + +From: Pavel Begunkov + +commit 67c007d6c12da3e456c005083696c20d4498ae72 upstream. + +refcount_t: underflow; use-after-free. +WARNING: CPU: 0 PID: 5823 at lib/refcount.c:28 refcount_warn_saturate+0x15a/0x1d0 lib/refcount.c:28 +RIP: 0010:refcount_warn_saturate+0x15a/0x1d0 lib/refcount.c:28 +Call Trace: + + io_notif_flush io_uring/notif.h:40 [inline] + io_send_zc_cleanup+0x121/0x170 io_uring/net.c:1222 + io_clean_op+0x58c/0x9a0 io_uring/io_uring.c:406 + io_free_batch_list io_uring/io_uring.c:1429 [inline] + __io_submit_flush_completions+0xc16/0xd20 io_uring/io_uring.c:1470 + io_submit_flush_completions io_uring/io_uring.h:159 [inline] + +Before the blamed commit, sendzc relied on io_req_msg_cleanup() to clear +REQ_F_NEED_CLEANUP, so after the following snippet the request will +never hit the core io_uring cleanup path. + +io_notif_flush(); +io_req_msg_cleanup(); + +The easiest fix is to null the notification. io_send_zc_cleanup() can +still be called after, but it's tolerated. + +Reported-by: syzbot+cf285a028ffba71b2ef5@syzkaller.appspotmail.com +Tested-by: syzbot+cf285a028ffba71b2ef5@syzkaller.appspotmail.com +Fixes: cc34d8330e036 ("io_uring/net: don't clear REQ_F_NEED_CLEANUP unconditionally") +Signed-off-by: Pavel Begunkov +Link: https://lore.kernel.org/r/e1306007458b8891c88c4f20c966a17595f766b0.1742643795.git.asml.silence@gmail.com +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + io_uring/net.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/io_uring/net.c ++++ b/io_uring/net.c +@@ -1427,6 +1427,7 @@ int io_send_zc(struct io_kiocb *req, uns + */ + if (!(issue_flags & IO_URING_F_UNLOCKED)) { + io_notif_flush(zc->notif); ++ zc->notif = NULL; + io_req_msg_cleanup(req, 0); + } + io_req_set_res(req, ret, IORING_CQE_F_MORE); +@@ -1487,6 +1488,7 @@ int io_sendmsg_zc(struct io_kiocb *req, + */ + if (!(issue_flags & IO_URING_F_UNLOCKED)) { + io_notif_flush(sr->notif); ++ sr->notif = NULL; + io_req_msg_cleanup(req, 0); + } + io_req_set_res(req, ret, IORING_CQE_F_MORE); diff --git a/queue-6.12/series b/queue-6.12/series index 6e34f713bb..b4a5984671 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -100,3 +100,4 @@ drm-amdgpu-fix-mpeg2-mpeg4-and-vc1-video-caps-max-size.patch drm-amdgpu-fix-jpeg-video-caps-max-size-for-navi1x-and-raven.patch drm-amdkfd-fix-user-queue-validation-on-gfx7-8.patch ksmbd-fix-incorrect-validation-for-num_aces-field-of-smb_acl.patch +io_uring-net-fix-sendzc-double-notif-flush.patch