diff options
| author | Jens Axboe <axboe@kernel.dk> | 2025-01-22 17:03:28 -0700 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-02-08 10:02:17 +0100 |
| commit | 0184d8a3b94fc24262f08cd4165e7a02864b365c (patch) | |
| tree | 22a700b5b64ddad7e19169c98639b10bdcbda51b /io_uring | |
| parent | 4eed8bd68aa370a1d7a2f58aedb225a6c3a06921 (diff) | |
| download | linux-0184d8a3b94fc24262f08cd4165e7a02864b365c.tar.gz linux-0184d8a3b94fc24262f08cd4165e7a02864b365c.tar.bz2 linux-0184d8a3b94fc24262f08cd4165e7a02864b365c.zip | |
io_uring/msg_ring: don't leave potentially dangling ->tctx pointer
[ Upstream commit 69a62e03f896a7382671877b6ad6aab87c53e9c3 ]
For remote posting of messages, req->tctx is assigned even though it
is never used. Rather than leave a dangling pointer, just clear it to
NULL and use the previous check for a valid submitter_task to gate on
whether or not the request should be terminated.
Reported-by: Jann Horn <jannh@google.com>
Fixes: b6f58a3f4aa8 ("io_uring: move struct io_kiocb from task_struct to io_uring_task")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'io_uring')
| -rw-r--r-- | io_uring/msg_ring.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/io_uring/msg_ring.c b/io_uring/msg_ring.c index 333c220d322a..800cd48001e6 100644 --- a/io_uring/msg_ring.c +++ b/io_uring/msg_ring.c @@ -89,8 +89,7 @@ static void io_msg_tw_complete(struct io_kiocb *req, struct io_tw_state *ts) static int io_msg_remote_post(struct io_ring_ctx *ctx, struct io_kiocb *req, int res, u32 cflags, u64 user_data) { - req->tctx = READ_ONCE(ctx->submitter_task->io_uring); - if (!req->tctx) { + if (!READ_ONCE(ctx->submitter_task)) { kmem_cache_free(req_cachep, req); return -EOWNERDEAD; } @@ -98,6 +97,7 @@ static int io_msg_remote_post(struct io_ring_ctx *ctx, struct io_kiocb *req, io_req_set_res(req, res, cflags); percpu_ref_get(&ctx->refs); req->ctx = ctx; + req->tctx = NULL; req->io_task_work.func = io_msg_tw_complete; io_req_task_work_add_remote(req, ctx, IOU_F_TWQ_LAZY_WAKE); return 0; |