Skip to content
Snippets Groups Projects
Commit 46a8cd03 authored by Jens Axboe's avatar Jens Axboe Committed by Yongqiang Liu
Browse files

io_uring: always grab file table for deferred statx

stable inclusion
from stable-v5.10.118
commit 3c48558be571e01f67e65edcf03193484eeb2b79
category: bugfix
bugzilla: 187134, https://gitee.com/openeuler/kernel/issues/I5HEXY
CVE: NA

--------------------------------

Lee reports that there's a use-after-free of the process file table.
There's an assumption that we don't need the file table for some
variants of statx invocation, but that turns out to be false and we
end up with not grabbing a reference for the request even if the
deferred execution uses it.

Get rid of the REQ_F_NO_FILE_TABLE optimization for statx, and always
grab that reference.

This issues doesn't exist upstream since the native workers got
introduced with 5.12.

Link: https://lore.kernel.org/io-uring/YoOJ%2FT4QRKC+fAZE@google.com/


Reported-by: default avatarLee Jones <lee.jones@linaro.org>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarLi Lingfeng <lilingfeng3@huawei.com>
Reviewed-by: default avatarZhang Yi <yi.zhang@huawei.com>
Signed-off-by: default avatarYongqiang Liu <liuyongqiang13@huawei.com>
parent 47e8d3ac
No related branches found
No related tags found
No related merge requests found
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment