Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
io_uring/futex: ensure io_futex_wait() cleans up properly on failure
The io_futex_data is allocated upfront and assigned to the io_kiocb
async_data field, but the request isn't marked with REQ_F_ASYNC_DATA
at that point. Those two should always go together, as the flag tells
io_uring whether the field is valid or not.
Additionally, on failure cleanup, the futex handler frees the data but
does not clear ->async_data. Clear the data and the flag in the error
path as well.
Thanks to Trend Micro Zero Day Initiative and particularly ReDress for
reporting this.
Cc: stable@vger.kernel.org
Fixes: 194bb58c6090 ("io_uring: add support for futex wake and wait")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
+3
+3
io_uring/futex.c
+3
io_uring/futex.c
···
288
288
goto done_unlock;
289
289
}
290
290
291
+
req->flags |= REQ_F_ASYNC_DATA;
291
292
req->async_data = ifd;
292
293
ifd->q = futex_q_init;
293
294
ifd->q.bitset = iof->futex_mask;
···
310
309
if (ret < 0)
311
310
req_set_fail(req);
312
311
io_req_set_res(req, ret, 0);
312
+
req->async_data = NULL;
313
+
req->flags &= ~REQ_F_ASYNC_DATA;
313
314
kfree(ifd);
314
315
return IOU_COMPLETE;
315
316
}