tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

io_uring: protect mem region deregistration

io_create_region_mmap_safe() protects publishing of a region against
concurrent mmap calls, however we should also protect against it when
removing a region. There is a gap io_register_mem_region() where it
safely publishes a region, but then copy_to_user goes wrong and it
unsafely frees the region.

Cc: stable@vger.kernel.org
Fixes: 087f997870a94 ("io_uring/memmap: implement mmap for regions")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

authored by

Pavel Begunkov and committed by
Jens Axboe be7cab44 927069c4

+1
+1
io_uring/register.c
··· 613 613 if (ret) 614 614 return ret; 615 615 if (copy_to_user(rd_uptr, &rd, sizeof(rd))) { 616 + guard(mutex)(&ctx->mmap_lock); 616 617 io_free_region(ctx, &ctx->param_region); 617 618 return -EFAULT; 618 619 }