diff options
| author | Liu Yong <pkfxxxing@gmail.com> | 2020-08-12 23:56:44 -0700 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-08-19 08:15:53 +0200 |
| commit | a02df82a59c3dbc7bf657efca82e1641ca472eb4 (patch) | |
| tree | 52d878f9ce87a8a332e626468817e2599f0246f7 /fs/io_uring.c | |
| parent | bd1584865c12a90d7928c2646eb581518a3600e0 (diff) | |
| download | linux-stable-a02df82a59c3dbc7bf657efca82e1641ca472eb4.tar.gz linux-stable-a02df82a59c3dbc7bf657efca82e1641ca472eb4.tar.bz2 linux-stable-a02df82a59c3dbc7bf657efca82e1641ca472eb4.zip | |
fs/io_uring.c: Fix uninitialized variable is referenced in io_submit_sqe
the commit <a4d61e66ee4a> ("<io_uring: prevent re-read of sqe->opcode>")
caused another vulnerability. After io_get_req(), the sqe_submit struct
in req is not initialized, but the following code defaults that
req->submit.opcode is available.
Signed-off-by: Liu Yong <pkfxxxing@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'fs/io_uring.c')
| -rw-r--r-- | fs/io_uring.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/fs/io_uring.c b/fs/io_uring.c index be3d595a607f..c1aaee061dae 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -2559,6 +2559,7 @@ static void io_submit_sqe(struct io_ring_ctx *ctx, struct sqe_submit *s, goto err; } + memcpy(&req->submit, s, sizeof(*s)); ret = io_req_set_file(ctx, s, state, req); if (unlikely(ret)) { err_req: |