Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'io_uring-6.19-20251226' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull io_uring fix from Jens Axboe:
"Just a single fix for a bug that can cause a leak of the filename with
IORING_OP_OPENAT, if direct descriptors are asked for and O_CLOEXEC
has been set in the request flags"
* tag 'io_uring-6.19-20251226' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
io_uring: fix filename leak in __io_openat_prep()
+1
-1
+1
-1
io_uring/openclose.c
+1
-1
io_uring/openclose.c
···
73
73
open->filename = NULL;
74
74
return ret;
75
75
}
76
+
req->flags |= REQ_F_NEED_CLEANUP;
76
77
77
78
open->file_slot = READ_ONCE(sqe->file_index);
78
79
if (open->file_slot && (open->how.flags & O_CLOEXEC))
79
80
return -EINVAL;
80
81
81
82
open->nofile = rlimit(RLIMIT_NOFILE);
82
-
req->flags |= REQ_F_NEED_CLEANUP;
83
83
if (io_openat_force_async(open))
84
84
req->flags |= REQ_F_FORCE_ASYNC;
85
85
return 0;