| commit | f1d96a8fcbbbb22d4fbc1d69eaaa678bbb0ff6e2 | |
| author | Pavel Begunkov <asml.silence@gmail.com> | |
| Fri, 13 Mar 2020 19:29:14 +0000 (13 22:29 +0300) | ||
| committer | Jens Axboe <axboe@kernel.dk> | |
| Sat, 14 Mar 2020 22:57:41 +0000 (14 16:57 -0600) | ||
| tree | 8a3a3856eec59a94b9a2f7bba37127b982cf7d48 | treesnapshot (tar.gz zip) |
| parent | 805b13adde3964c78cba125a15527e88c19f87b3 | commitdiff |
io_uring: NULL-deref for IOSQE_{ASYNC,DRAIN}
Processing links, io_submit_sqe() prepares requests, drops sqes, and
passes them with sqe=NULL to io_queue_sqe(). There IOSQE_DRAIN and/or
IOSQE_ASYNC requests will go through the same prep, which doesn't expect
sqe=NULL and fail with NULL pointer deference.
Always do full prepare including io_alloc_async_ctx() for linked
requests, and then it can skip the second preparation.
Cc: stable@vger.kernel.org # 5.5
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Processing links, io_submit_sqe() prepares requests, drops sqes, and
passes them with sqe=NULL to io_queue_sqe(). There IOSQE_DRAIN and/or
IOSQE_ASYNC requests will go through the same prep, which doesn't expect
sqe=NULL and fail with NULL pointer deference.
Always do full prepare including io_alloc_async_ctx() for linked
requests, and then it can skip the second preparation.
Cc: stable@vger.kernel.org # 5.5
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
| fs/io_uring.c | diffblobblamehistory |