From 78752da1c6bff4652005000d2dfb0171e13ca1b5 Mon Sep 17 00:00:00 2001 From: CKI Backport Bot Date: Fri, 1 May 2026 16:51:46 +0000 Subject: [PATCH] io_uring/rsrc: reject zero-length fixed buffer import JIRA: https://redhat.atlassian.net/browse/RHEL-172557 CVE: CVE-2026-43006 commit 111a12b422a8cfa93deabaef26fec48237163214 Author: Qi Tang Date: Mon Mar 30 00:49:36 2026 +0800 io_uring/rsrc: reject zero-length fixed buffer import validate_fixed_range() admits buf_addr at the exact end of the registered region when len is zero, because the check uses strict greater-than (buf_end > imu->ubuf + imu->len). io_import_fixed() then computes offset == imu->len, which causes the bvec skip logic to advance past the last bio_vec entry and read bv_offset from out-of-bounds slab memory. Return early from io_import_fixed() when len is zero. A zero-length import has no data to transfer and should not walk the bvec array at all. BUG: KASAN: slab-out-of-bounds in io_import_reg_buf+0x697/0x7f0 Read of size 4 at addr ffff888002bcc254 by task poc/103 Call Trace: io_import_reg_buf+0x697/0x7f0 io_write_fixed+0xd9/0x250 __io_issue_sqe+0xad/0x710 io_issue_sqe+0x7d/0x1100 io_submit_sqes+0x86a/0x23c0 __do_sys_io_uring_enter+0xa98/0x1590 Allocated by task 103: The buggy address is located 12 bytes to the right of allocated 584-byte region [ffff888002bcc000, ffff888002bcc248) Fixes: 8622b20f23ed ("io_uring: add validate_fixed_range() for validate fixed buffer") Signed-off-by: Qi Tang Link: https://patch.msgid.link/20260329164936.240871-1-tpluszz77@gmail.com Signed-off-by: Jens Axboe Signed-off-by: CKI Backport Bot diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c index 5b40f7992e41..3f0a7c0efd25 100644 --- a/io_uring/rsrc.c +++ b/io_uring/rsrc.c @@ -1072,6 +1072,10 @@ static int io_import_fixed(int ddir, struct iov_iter *iter, return ret; if (!(imu->dir & (1 << ddir))) return -EFAULT; + if (unlikely(!len)) { + iov_iter_bvec(iter, ddir, NULL, 0, 0); + return 0; + } offset = buf_addr - imu->ubuf; -- 2.50.1 (Apple Git-155)