• Pavel Begunkov's avatar
    io_uring: NULL files dereference by SQPOLL · 1a38ffc9
    Pavel Begunkov authored
    SQPOLL task may find sqo_task->files == NULL and
    __io_sq_thread_acquire_files() would leave it unset, so following
    fget_many() and others try to dereference NULL and fault. Propagate
    an error files are missing.
    
    [  118.962785] BUG: kernel NULL pointer dereference, address:
    	0000000000000020
    [  118.963812] #PF: supervisor read access in kernel mode
    [  118.964534] #PF: error_code(0x0000) - not-present page
    [  118.969029] RIP: 0010:__fget_files+0xb/0x80
    [  119.005409] Call Trace:
    [  119.005651]  fget_many+0x2b/0x30
    [  119.005964]  io_file_get+0xcf/0x180
    [  119.006315]  io_submit_sqes+0x3a4/0x950
    [  119.007481]  io_sq_thread+0x1de/0x6a0
    [  119.007828]  kthread+0x114/0x150
    [  119.008963]  ret_from_fork+0x22/0x30
    Reported-by: default avatarJosef Grieb <josef.grieb@gmail.com>
    Signed-off-by: default avatarPavel Begunkov <asml.silence@gmail.com>
    Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
    1a38ffc9
io_uring.c 242 KB