Description
In the Linux kernel, the following vulnerability has been resolved: block: reject polled dio with user integrity metadata IOCB_HAS_METADATA leaves iocb->private as a uio_meta, while iocb_bio_iopoll() expects a bio. Since 2729a60bbfb9, metadata I/O always uses __blkdev_direct_IO(), which never publishes the bio for polling, so IOPOLL calls bio_poll() on the uio_meta. Reproducer: io_uring IOPOLL plus a PI attribute on an integrity device (scsi_debug dif=1 dix=1). KASAN reports: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000004 KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] RIP: 0010:bio_poll+0x9d/0x4b0 Call Trace: iocb_bio_iopoll+0x5b/0x80 io_uring_classic_poll+0xf3/0x140 io_do_iopoll+0x4e3/0xc00 io_iopoll_check+0x275/0x560 __do_sys_io_uring_enter+0x2e5/0x720 Return -EOPNOTSUPP when HIPRI is combined with user metadata.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
2729a60bbfb9215997f25372ebe9b7964f038296 to < c97ef13ad96be0e08af38dfa2ed40cded0b53e1baffected2729a60bbfb9215997f25372ebe9b7964f038296 to < dd33c03cefccdfcb223e9e6262643d64f8c1ae20affected2729a60bbfb9215997f25372ebe9b7964f038296 to < 2a42e6fe1293f2e2d579c9fe5bbab056dd8b880eaffected17ecefc9fdd8c554e0d03e5a990daef19f930addaffected6.16.8 to < 6.17affected
Linux Linux
Default version status: affected
6.17affected0 to < 6.17unaffected6.18.56 to ≤ 6.18.*unaffected7.2.10 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected