CVE-2023-53511

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

io_uring: fix fget leak when fs don't support nowait buffered read

Heming reported a BUG when using io_uring doing link-cp on ocfs2. [1]

Do the following steps can reproduce this BUG:

mount -t ocfs2 /dev/vdc /mnt/ocfs2

cp testfile /mnt/ocfs2/

./link-cp /mnt/ocfs2/testfile /mnt/ocfs2/testfile.1

umount /mnt/ocfs2

Then umount will fail, and it outputs:

umount: /mnt/ocfs2: target is busy.

While tracing umount, it blames mnt_get_count() not return as expected.

Do a deep investigation for fget()/fput() on related code flow, I've

finally found that fget() leaks since ocfs2 doesn't support nowait

buffered read.

io_issue_sqe

|-io_assign_file // do fget() first

|-io_read

|-io_iter_do_read

|-ocfs2_file_read_iter // return -EOPNOTSUPP

|-kiocb_done

|-io_rw_done

|-__io_complete_rw_common // set REQ_F_REISSUE

|-io_resubmit_prep

|-io_req_prep_async // override req->file, leak happens

This was i

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References