Commit 1caf50ce authored Feb 06, 2026 by Chao Yu Committed by Gao Xiang Feb 06, 2026

erofs: fix UAF issue for file-backed mounts w/ directio option



[    9.269940][ T3222] Call trace:
[    9.269948][ T3222]  ext4_file_read_iter+0xac/0x108
[    9.269979][ T3222]  vfs_iocb_iter_read+0xac/0x198
[    9.269993][ T3222]  erofs_fileio_rq_submit+0x12c/0x180
[    9.270008][ T3222]  erofs_fileio_submit_bio+0x14/0x24
[    9.270030][ T3222]  z_erofs_runqueue+0x834/0x8ac
[    9.270054][ T3222]  z_erofs_read_folio+0x120/0x220
[    9.270083][ T3222]  filemap_read_folio+0x60/0x120
[    9.270102][ T3222]  filemap_fault+0xcac/0x1060
[    9.270119][ T3222]  do_pte_missing+0x2d8/0x1554
[    9.270131][ T3222]  handle_mm_fault+0x5ec/0x70c
[    9.270142][ T3222]  do_page_fault+0x178/0x88c
[    9.270167][ T3222]  do_translation_fault+0x38/0x54
[    9.270183][ T3222]  do_mem_abort+0x54/0xac
[    9.270208][ T3222]  el0_da+0x44/0x7c
[    9.270227][ T3222]  el0t_64_sync_handler+0x5c/0xf4
[    9.270253][ T3222]  el0t_64_sync+0x1bc/0x1c0

EROFS may encounter above panic when enabling file-backed mount w/
directio mount option, the root cause is it may suffer UAF in below
race condition:

- z_erofs_read_folio                          wq s_dio_done_wq
 - z_erofs_runqueue
  - erofs_fileio_submit_bio
   - erofs_fileio_rq_submit
    - vfs_iocb_iter_read
     - ext4_file_read_iter
      - ext4_dio_read_iter
       - iomap_dio_rw
       : bio was submitted and return -EIOCBQUEUED
                                              - dio_aio_complete_work
                                               - dio_complete
                                                - dio->iocb->ki_complete (erofs_fileio_ki_complete())
                                                 - kfree(rq)
                                                 : it frees iocb, iocb.ki_filp can be UAF in file_accessed().
       - file_accessed
       : access NULL file point

Introduce a reference count in struct erofs_fileio_rq, and initialize it
as two, both erofs_fileio_ki_complete() and erofs_fileio_rq_submit() will
decrease reference count, the last one decreasing the reference count
to zero will free rq.

Cc: stable@kernel.org
Fixes: fb176750 ("erofs: add file-backed mount support")
Fixes: 6422cde1 ("erofs: use buffered I/O for file-backed mounts by default")
Signed-off-by: Chao Yu <chao@kernel.org>
Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>

parent 8f2fb72f

fs/erofs/fileio.c

+6 −1

Original line number	Diff line number	Diff line
		@@ -10,6 +10,7 @@ struct erofs_fileio_rq {
		struct bio bio;
		struct kiocb iocb;
		struct super_block *sb;
		refcount_t ref;
		};

		struct erofs_fileio {
		@@ -38,6 +39,7 @@ static void erofs_fileio_ki_complete(struct kiocb *iocb, long ret)
		}
		bio_endio(&rq->bio);
		bio_uninit(&rq->bio);
		if (refcount_dec_and_test(&rq->ref))
		kfree(rq);
		}

		@@ -60,6 +62,8 @@ static void erofs_fileio_rq_submit(struct erofs_fileio_rq *rq)
		ret = vfs_iocb_iter_read(rq->iocb.ki_filp, &rq->iocb, &iter);
		if (ret != -EIOCBQUEUED)
		erofs_fileio_ki_complete(&rq->iocb, ret);
		if (refcount_dec_and_test(&rq->ref))
		kfree(rq);
		}

		static struct erofs_fileio_rq erofs_fileio_rq_alloc(struct erofs_map_dev mdev)
		@@ -70,6 +74,7 @@ static struct erofs_fileio_rq erofs_fileio_rq_alloc(struct erofs_map_dev mdev)
		bio_init(&rq->bio, NULL, rq->bvecs, ARRAY_SIZE(rq->bvecs), REQ_OP_READ);
		rq->iocb.ki_filp = mdev->m_dif->file;
		rq->sb = mdev->m_sb;
		refcount_set(&rq->ref, 2);
		return rq;
		}