BACKPORT: io_uring: always grab file table for deferred statx
Lee reports that there's a use-after-free of the process file table. There's an assumption that we don't need the file table for some variants of statx invocation, but that turns out to be false and we end up with not grabbing a reference for the request even if the deferred execution uses it. Get rid of the REQ_F_NO_FILE_TABLE optimization for statx, and always grab that reference. This issues doesn't exist upstream since the native workers got introduced with 5.12. Bug: 220738351 Link: https://lore.kernel.org/io-uring/YoOJ%2FT4QRKC+fAZE@google.com/ Reported-by:Lee Jones <lee.jones@linaro.org> Signed-off-by:
Jens Axboe <axboe@kernel.dk> Signed-off-by:
Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 3c48558b) Signed-off-by:
Lee Jones <joneslee@google.com> Change-Id: Ife51536d95368bffdc393ad2a5e737a0e6ddf18f
Loading
Please sign in to comment