In io_ring_buffers_peek(), when the buffer ring is expanded (KBUF_MODE_EXPAND), arg->iovs is set to a newly kmalloced array. If access_ok() then fails on a buffer entry, the error path kfrees the new array but does not restore arg->iovs to the original value (org_iovs). arg->iovs is left dangling and will be reused on retry, causing a use-after-free when the caller retries the buffer selection. Fix by restoring arg->iovs = org_iovs after the kfree on the error path, so the caller's state remains coherent on retry. Fixes: b3e0216c97e3 ("io_uring: add buffer ring support") Cc: io-uring@vger.kernel.org Signed-off-by: Aayush7352 --- io_uring/kbuf.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c index de0129bce..eab4de8a7 100644 --- a/io_uring/kbuf.c +++ b/io_uring/kbuf.c @@ -314,8 +314,10 @@ static int io_ring_buffers_peek(struct io_kiocb *req, struct buf_sel_arg *arg, iov->iov_base = u64_to_user_ptr(READ_ONCE(buf->addr)); iov->iov_len = len; if (unlikely(!access_ok(iov->iov_base, len))) { - if (arg->iovs != org_iovs) + if (arg->iovs != org_iovs) { kfree(arg->iovs); + arg->iovs = org_iovs; + } return -EFAULT; } iov++; -- 2.55.0