• Pavel Begunkov's avatar
    io_uring: NULL-deref for IOSQE_{ASYNC,DRAIN} · f1d96a8f
    Pavel Begunkov authored
    Processing links, io_submit_sqe() prepares requests, drops sqes, and
    passes them with sqe=NULL to io_queue_sqe(). There IOSQE_DRAIN and/or
    IOSQE_ASYNC requests will go through the same prep, which doesn't expect
    sqe=NULL and fail with NULL pointer deference.
    
    Always do full prepare including io_alloc_async_ctx() for linked
    requests, and then it can skip the second preparation.
    
    Cc: stable@vger.kernel.org # 5.5
    Signed-off-by: default avatarPavel Begunkov <asml.silence@gmail.com>
    Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
    f1d96a8f
io_uring.c 170 KB