In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
io_uring\/cmd: fix iovec leak when the async cmd is not recycled<\/p>\n
An io_async_cmd carries an iovec array in ->vec.iovec, allocated when the
\nvec has to grow and kept across recycling through ctx->cmd_cache. On two
\npaths nothing frees it and io_clean_op()’s kfree(req->async_data) drops
\nthe io_async_cmd without it.<\/p>\n
io_req_uring_cleanup() clears the async data flags only when
\nio_alloc_cache_put() succeeds, and the cache holds IO_ALLOC_CACHE_MAX ==
\n128 entries, so once it is full the put fails and the vec is left behind.
\nAn NVMe passthrough workload gets there without doing anything unusual:
\nnvme_uring_cmd_io() returns -EIOCBQUEUED, so the io_async_cmd stays
\nattached for the lifetime of the command and the live object count tracks
\nthe queue depth. Above 128 the puts start failing.<\/p>\n
->cleanup is the last chance to free an inherited vec, since
\nio_req_uring_cleanup() returns early for an io-wq issued command and is
\nnot called at all for one completed without ever being issued. But
\nio_clean_op() calls ->cleanup only if REQ_F_NEED_CLEANUP is set, and for
\nuring_cmd that happens only where the vec has to grow, so a command
\nreusing a large enough cached vec never sets it. io_rw_alloc_async() and
\nio_msg_alloc_async() flag an inherited vec for exactly this reason;
\nio_uring_cmd_prep() does not.<\/p>\n
Flag an inherited vec in io_uring_cmd_prep(), and free the vec when the
\ncache put fails, as io_req_rw_cleanup() does.<\/p>\n
The leak is invisible under KASAN, where io_alloc_cache_vec_kasan() frees
\nthe vec unconditionally.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
io_uring\/cmd: fix iovec leak when the async cmd is not recycled<\/p>\n
An io_async_cmd carries an iovec array in ->vec.iovec, allocated w<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-17315","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/17315","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=17315"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=17315"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=17315"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}