CVE-2025-38453

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU<br /> <br /> syzbot reports that defer/local task_work adding via msg_ring can hit<br /> a request that has been freed:<br /> <br /> CPU: 1 UID: 0 PID: 19356 Comm: iou-wrk-19354 Not tainted 6.16.0-rc4-syzkaller-00108-g17bbde2e1716 #0 PREEMPT(full)<br /> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025<br /> Call Trace:<br /> <br /> dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120<br /> print_address_description mm/kasan/report.c:408 [inline]<br /> print_report+0xd2/0x2b0 mm/kasan/report.c:521<br /> kasan_report+0x118/0x150 mm/kasan/report.c:634<br /> io_req_local_work_add io_uring/io_uring.c:1184 [inline]<br /> __io_req_task_work_add+0x589/0x950 io_uring/io_uring.c:1252<br /> io_msg_remote_post io_uring/msg_ring.c:103 [inline]<br /> io_msg_data_remote io_uring/msg_ring.c:133 [inline]<br /> __io_msg_ring_data+0x820/0xaa0 io_uring/msg_ring.c:151<br /> io_msg_ring_data io_uring/msg_ring.c:173 [inline]<br /> io_msg_ring+0x134/0xa00 io_uring/msg_ring.c:314<br /> __io_issue_sqe+0x17e/0x4b0 io_uring/io_uring.c:1739<br /> io_issue_sqe+0x165/0xfd0 io_uring/io_uring.c:1762<br /> io_wq_submit_work+0x6e9/0xb90 io_uring/io_uring.c:1874<br /> io_worker_handle_work+0x7cd/0x1180 io_uring/io-wq.c:642<br /> io_wq_worker+0x42f/0xeb0 io_uring/io-wq.c:696<br /> ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148<br /> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245<br /> <br /> <br /> which is supposed to be safe with how requests are allocated. But msg<br /> ring requests alloc and free on their own, and hence must defer freeing<br /> to a sane time.<br /> <br /> Add an rcu_head and use kfree_rcu() in both spots where requests are<br /> freed. Only the one in io_msg_tw_complete() is strictly required as it<br /> has been visible on the other ring, but use it consistently in the other<br /> spot as well.<br /> <br /> This should not cause any other issues outside of KASAN rightfully<br /> complaining about it.