diff options
| author | Pavel Begunkov <asml.silence@gmail.com> | 2020-03-13 22:29:14 +0300 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2020-03-15 01:57:41 +0300 |
| commit | f1d96a8fcbbbb22d4fbc1d69eaaa678bbb0ff6e2 (patch) | |
| tree | 8a3a3856eec59a94b9a2f7bba37127b982cf7d48 | |
| parent | 805b13adde3964c78cba125a15527e88c19f87b3 (diff) | |
| download | linux-f1d96a8fcbbbb22d4fbc1d69eaaa678bbb0ff6e2.tar.xz | |
io_uring: NULL-deref for IOSQE_{ASYNC,DRAIN}
Processing links, io_submit_sqe() prepares requests, drops sqes, and
passes them with sqe=NULL to io_queue_sqe(). There IOSQE_DRAIN and/or
IOSQE_ASYNC requests will go through the same prep, which doesn't expect
sqe=NULL and fail with NULL pointer deference.
Always do full prepare including io_alloc_async_ctx() for linked
requests, and then it can skip the second preparation.
Cc: stable@vger.kernel.org # 5.5
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
| -rw-r--r-- | fs/io_uring.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/fs/io_uring.c b/fs/io_uring.c index 1b2517291b78..b1fbc4424aa6 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -4131,6 +4131,9 @@ static int io_req_defer_prep(struct io_kiocb *req, { ssize_t ret = 0; + if (!sqe) + return 0; + if (io_op_defs[req->opcode].file_table) { ret = io_grab_files(req); if (unlikely(ret)) @@ -4907,6 +4910,11 @@ err_req: if (sqe_flags & (IOSQE_IO_LINK|IOSQE_IO_HARDLINK)) { req->flags |= REQ_F_LINK; INIT_LIST_HEAD(&req->link_list); + + if (io_alloc_async_ctx(req)) { + ret = -EAGAIN; + goto err_req; + } ret = io_req_defer_prep(req, sqe); if (ret) req->flags |= REQ_F_FAIL_LINK; |