In the Linux kernel, the following vulnerability has been resolved:
io_uring: fix fget leak when fs don't support nowait buffered read
Heming reported a BUG when using io_uring doing link-cp on ocfs2. [1]
Do the following steps can reproduce this BUG: mount -t ocfs2 /dev/vdc /mnt/ocfs2 cp testfile /mnt/ocfs2/ ./link-cp /mnt/ocfs2/testfile /mnt/ocfs2/testfile.1 umount /mnt/ocfs2
Then umount will fail, and it outputs: umount: /mnt/ocfs2: target is busy.
While tracing umount, it blames mntgetcount() not return as expected. Do a deep investigation for fget()/fput() on related code flow, I've finally found that fget() leaks since ocfs2 doesn't support nowait buffered read.
ioissuesqe |-ioassignfile // do fget() first |-ioread |-ioiterdoread |-ocfs2filereaditer // return -EOPNOTSUPP |-kiocbdone |-iorwdone |-_iocompleterwcommon // set REQFREISSUE |-ioresubmitprep |-ioreqprep_async // override req->file, leak happens
This was introduced by commit a196c78b5443 in v5.18. Fix it by don't re-assign req->file if it has already been assigned.
[1] https://lore.kernel.org/ocfs2-devel/ab580a75-91c8-d68a-3455-40361be1bfa8@linux.alibaba.com/T/#t
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53511.json",
"cna_assigner": "Linux"
}[
{
"target": {
"function": "io_req_prep_async",
"file": "io_uring/io_uring.c"
},
"id": "CVE-2023-53511-2f5ea691",
"deprecated": false,
"digest": {
"length": 485.0,
"function_hash": "201742941152089194795758359356597820065"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@54aa7f2330b82884f4a1afce0220add6e8312f8b",
"signature_version": "v1"
},
{
"target": {
"file": "io_uring/io_uring.c"
},
"id": "CVE-2023-53511-6f08aa5f",
"deprecated": false,
"digest": {
"line_hashes": [
"226862439707636349806160539253872782392",
"102772319640087979942191409595485501184",
"17364898917743366876243401298002526177",
"242920278751397424368321636200698715425"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@54aa7f2330b82884f4a1afce0220add6e8312f8b",
"signature_version": "v1"
},
{
"target": {
"file": "io_uring/io_uring.c"
},
"id": "CVE-2023-53511-7b28879f",
"deprecated": false,
"digest": {
"line_hashes": [
"14402748424153132269332433956143265168",
"336424240500929073594653119731274825866",
"235106798015694713610773066795015227610",
"208293778074799765105335116381774025796"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@75a499fc9d66a32271e2b3e4ca71156e8ad3b484",
"signature_version": "v1"
},
{
"target": {
"function": "io_req_prep_async",
"file": "io_uring/io_uring.c"
},
"id": "CVE-2023-53511-87845678",
"deprecated": false,
"digest": {
"length": 451.0,
"function_hash": "162463838282979148493178203375061289543"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@75a499fc9d66a32271e2b3e4ca71156e8ad3b484",
"signature_version": "v1"
},
{
"target": {
"function": "io_req_prep_async",
"file": "io_uring/io_uring.c"
},
"id": "CVE-2023-53511-c75b10e6",
"deprecated": false,
"digest": {
"length": 451.0,
"function_hash": "162463838282979148493178203375061289543"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@10fb2e16ee6ffaf1716b9e90d007e6b300bfa457",
"signature_version": "v1"
},
{
"target": {
"file": "io_uring/io_uring.c"
},
"id": "CVE-2023-53511-f8a4279c",
"deprecated": false,
"digest": {
"line_hashes": [
"14402748424153132269332433956143265168",
"336424240500929073594653119731274825866",
"235106798015694713610773066795015227610",
"208293778074799765105335116381774025796"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@10fb2e16ee6ffaf1716b9e90d007e6b300bfa457",
"signature_version": "v1"
}
]
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-53511.json"