diff options
| author | Jens Axboe <axboe@kernel.dk> | 2023-06-12 22:51:36 +0300 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2023-06-14 04:26:42 +0300 |
| commit | cac9e4418f4cbd548ccb065b3adcafe073f7f7d2 (patch) | |
| tree | ef49d2c9a2399b2b577b11261cfd3618a588e345 /mm/memremap.c | |
| parent | b6dad5178ceaf23f369c3711062ce1f2afc33644 (diff) | |
| download | linux-cac9e4418f4cbd548ccb065b3adcafe073f7f7d2.tar.xz | |
io_uring/net: save msghdr->msg_control for retries
If the application sets ->msg_control and we have to later retry this
command, or if it got queued with IOSQE_ASYNC to begin with, then we
need to retain the original msg_control value. This is due to the net
stack overwriting this field with an in-kernel pointer, to copy it
in. Hitting that path for the second time will now fail the copy from
user, as it's attempting to copy from a non-user address.
Cc: stable@vger.kernel.org # 5.10+
Link: https://github.com/axboe/liburing/issues/880
Reported-and-tested-by: Marek Majkowski <marek@cloudflare.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'mm/memremap.c')
0 files changed, 0 insertions, 0 deletions