Andrew Lukoshko
b9d46fff46
Add the RHEL 211.17.1..211.18.1 backports (1162-1244) from centos-stream-10 and upstream, on top of 211.16.1. Includes the lpfc 14.4.0.x revert batch and the RHEL-only lpfc_nlp_get UAF guard. Bump to 211.18.1.
64 lines
2.3 KiB
Diff
64 lines
2.3 KiB
Diff
From 78752da1c6bff4652005000d2dfb0171e13ca1b5 Mon Sep 17 00:00:00 2001
|
|
From: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com>
|
|
Date: Fri, 1 May 2026 16:51:46 +0000
|
|
Subject: [PATCH] io_uring/rsrc: reject zero-length fixed buffer import
|
|
|
|
JIRA: https://redhat.atlassian.net/browse/RHEL-172557
|
|
CVE: CVE-2026-43006
|
|
|
|
commit 111a12b422a8cfa93deabaef26fec48237163214
|
|
Author: Qi Tang <tpluszz77@gmail.com>
|
|
Date: Mon Mar 30 00:49:36 2026 +0800
|
|
|
|
io_uring/rsrc: reject zero-length fixed buffer import
|
|
|
|
validate_fixed_range() admits buf_addr at the exact end of the
|
|
registered region when len is zero, because the check uses strict
|
|
greater-than (buf_end > imu->ubuf + imu->len). io_import_fixed()
|
|
then computes offset == imu->len, which causes the bvec skip logic
|
|
to advance past the last bio_vec entry and read bv_offset from
|
|
out-of-bounds slab memory.
|
|
|
|
Return early from io_import_fixed() when len is zero. A zero-length
|
|
import has no data to transfer and should not walk the bvec array
|
|
at all.
|
|
|
|
BUG: KASAN: slab-out-of-bounds in io_import_reg_buf+0x697/0x7f0
|
|
Read of size 4 at addr ffff888002bcc254 by task poc/103
|
|
Call Trace:
|
|
io_import_reg_buf+0x697/0x7f0
|
|
io_write_fixed+0xd9/0x250
|
|
__io_issue_sqe+0xad/0x710
|
|
io_issue_sqe+0x7d/0x1100
|
|
io_submit_sqes+0x86a/0x23c0
|
|
__do_sys_io_uring_enter+0xa98/0x1590
|
|
Allocated by task 103:
|
|
The buggy address is located 12 bytes to the right of
|
|
allocated 584-byte region [ffff888002bcc000, ffff888002bcc248)
|
|
|
|
Fixes: 8622b20f23ed ("io_uring: add validate_fixed_range() for validate fixed buffer")
|
|
Signed-off-by: Qi Tang <tpluszz77@gmail.com>
|
|
Link: https://patch.msgid.link/20260329164936.240871-1-tpluszz77@gmail.com
|
|
Signed-off-by: Jens Axboe <axboe@kernel.dk>
|
|
|
|
Signed-off-by: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com>
|
|
|
|
diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c
|
|
index 5b40f7992e41..3f0a7c0efd25 100644
|
|
--- a/io_uring/rsrc.c
|
|
+++ b/io_uring/rsrc.c
|
|
@@ -1072,6 +1072,10 @@ static int io_import_fixed(int ddir, struct iov_iter *iter,
|
|
return ret;
|
|
if (!(imu->dir & (1 << ddir)))
|
|
return -EFAULT;
|
|
+ if (unlikely(!len)) {
|
|
+ iov_iter_bvec(iter, ddir, NULL, 0, 0);
|
|
+ return 0;
|
|
+ }
|
|
|
|
offset = buf_addr - imu->ubuf;
|
|
|
|
--
|
|
2.50.1 (Apple Git-155)
|
|
|