Commit bc80ea8a authored by Jens Axboe's avatar Jens Axboe Committed by Treehugger Robot
Browse files

BACKPORT: io_uring: always grab file table for deferred statx

Lee reports that there's a use-after-free of the process file table.
There's an assumption that we don't need the file table for some
variants of statx invocation, but that turns out to be false and we
end up with not grabbing a reference for the request even if the
deferred execution uses it.

Get rid of the REQ_F_NO_FILE_TABLE optimization for statx, and always
grab that reference.

This issues doesn't exist upstream since the native workers got
introduced with 5.12.

Bug: 220738351
Link: https://lore.kernel.org/io-uring/YoOJ%2FT4QRKC+fAZE@google.com/


Reported-by: default avatarLee Jones <lee.jones@linaro.org>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 3c48558b)
Signed-off-by: default avatarLee Jones <joneslee@google.com>
Change-Id: Ife51536d95368bffdc393ad2a5e737a0e6ddf18f
parent 0380da7f
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment