diff options
| author | Joanne Koong <joannelkoong@gmail.com> | 2025-11-25 21:13:47 +0300 |
|---|---|---|
| committer | Miklos Szeredi <mszeredi@redhat.com> | 2025-11-26 14:38:40 +0300 |
| commit | 95c39eef7c2b666026c69ab5b30471da94ea2874 (patch) | |
| tree | 99ac8c40f0aba24c6542539b81fa7bfd450d6c98 /scripts/patch-kernel | |
| parent | 28fec8b95e67704df7b841dc4cbbba0957078213 (diff) | |
| download | linux-95c39eef7c2b666026c69ab5b30471da94ea2874.tar.xz | |
fuse: fix io-uring list corruption for terminated non-committed requests
When a request is terminated before it has been committed, the request
is not removed from the queue's list. This leaves a dangling list entry
that leads to list corruption and use-after-free issues.
Remove the request from the queue's list for terminated non-committed
requests.
Signed-off-by: Joanne Koong <joannelkoong@gmail.com>
Fixes: c090c8abae4b ("fuse: Add io-uring sqe commit and fetch support")
Cc: stable@vger.kernel.org
Reviewed-by: Bernd Schubert <bschubert@ddn.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Diffstat (limited to 'scripts/patch-kernel')
0 files changed, 0 insertions, 0 deletions