Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
io_uring/msg_ring: don't leave potentially dangling ->tctx pointer
For remote posting of messages, req->tctx is assigned even though it
is never used. Rather than leave a dangling pointer, just clear it to
NULL and use the previous check for a valid submitter_task to gate on
whether or not the request should be terminated.
Reported-by: Jann Horn <jannh@google.com>
Fixes: b6f58a3f4aa8 ("io_uring: move struct io_kiocb from task_struct to io_uring_task")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
+2
-2
+2
-2
io_uring/msg_ring.c
+2
-2
io_uring/msg_ring.c
···
89
89
static int io_msg_remote_post(struct io_ring_ctx *ctx, struct io_kiocb *req,
90
90
int res, u32 cflags, u64 user_data)
91
91
{
92
-
req->tctx = READ_ONCE(ctx->submitter_task->io_uring);
93
-
if (!req->tctx) {
92
+
if (!READ_ONCE(ctx->submitter_task)) {
94
93
kmem_cache_free(req_cachep, req);
95
94
return -EOWNERDEAD;
96
95
}
···
97
98
io_req_set_res(req, res, cflags);
98
99
percpu_ref_get(&ctx->refs);
99
100
req->ctx = ctx;
101
+
req->tctx = NULL;
100
102
req->io_task_work.func = io_msg_tw_complete;
101
103
io_req_task_work_add_remote(req, ctx, IOU_F_TWQ_LAZY_WAKE);
102
104
return 0;