A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-05 19:31:57 -04:00
Code Issues Projects Releases Packages Wiki Activity

io_uring: Fix use-after-free in io_sq_wq_submit_work()

Browse source 
when ctx->sqo_mm is zero, io_sq_wq_submit_work() frees 'req'
without deleting it from 'task_list'. After that, 'req' is
accessed in io_ring_ctx_wait_and_kill() which lead to
a use-after-free.

Signed-off-by: Guoyu Huang <hgy5945@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Guoyu Huang 2020-08-05 13:10:25 -06:00 • committed by Greg Kroah-Hartman
commit e8053c6833
1 changed files with 1 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

1
fs/io_uring.c
View file

@ -2232,6 +2232,7 @@ restart:
if (io_req_needs_user(req) && !cur_mm) {
if (!mmget_not_zero(ctx->sqo_mm)) {
ret = -EFAULT;
goto end_req;
} else {
cur_mm = ctx->sqo_mm;
use_mm(cur_mm);