diff options
| author | Pavel Begunkov <asml.silence@gmail.com> | 2020-03-13 22:29:14 +0300 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2020-03-14 16:57:41 -0600 |
| commit | f1d96a8fcbbbb22d4fbc1d69eaaa678bbb0ff6e2 (patch) | |
| tree | 8a3a3856eec59a94b9a2f7bba37127b982cf7d48 /include/linux/socket.h | |
| parent | 805b13adde3964c78cba125a15527e88c19f87b3 (diff) | |
| download | linux-f1d96a8fcbbbb22d4fbc1d69eaaa678bbb0ff6e2.tar.gz linux-f1d96a8fcbbbb22d4fbc1d69eaaa678bbb0ff6e2.tar.bz2 linux-f1d96a8fcbbbb22d4fbc1d69eaaa678bbb0ff6e2.zip | |
io_uring: NULL-deref for IOSQE_{ASYNC,DRAIN}
Processing links, io_submit_sqe() prepares requests, drops sqes, and
passes them with sqe=NULL to io_queue_sqe(). There IOSQE_DRAIN and/or
IOSQE_ASYNC requests will go through the same prep, which doesn't expect
sqe=NULL and fail with NULL pointer deference.
Always do full prepare including io_alloc_async_ctx() for linked
requests, and then it can skip the second preparation.
Cc: stable@vger.kernel.org # 5.5
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'include/linux/socket.h')
0 files changed, 0 insertions, 0 deletions