44 lines
1.3 KiB
Diff
44 lines
1.3 KiB
Diff
From 2988d1717679b28423a316a92aaa7cae7fddceab Mon Sep 17 00:00:00 2001
|
|
From: Jens Axboe <axboe@kernel.dk>
|
|
Date: Thu, 21 Aug 2025 13:23:21 -0600
|
|
Subject: io_uring/futex: ensure io_futex_wait() cleans up properly on failure
|
|
|
|
The io_futex_data is allocated upfront and assigned to the io_kiocb
|
|
async_data field, but the request isn't marked with REQ_F_ASYNC_DATA
|
|
at that point. Those two should always go together, as the flag tells
|
|
io_uring whether the field is valid or not.
|
|
|
|
Additionally, on failure cleanup, the futex handler frees the data but
|
|
does not clear ->async_data. Clear the data and the flag in the error
|
|
path as well.
|
|
|
|
Thanks to Trend Micro Zero Day Initiative and particularly ReDress for
|
|
reporting this.
|
|
|
|
Cc: stable@vger.kernel.org
|
|
Fixes: 194bb58c6090 ("io_uring: add support for futex wake and wait")
|
|
Signed-off-by: Jens Axboe <axboe@kernel.dk>
|
|
---
|
|
io_uring/futex.c | 3 +++
|
|
1 file changed, 3 insertions(+)
|
|
|
|
--- a/io_uring/futex.c
|
|
+++ b/io_uring/futex.c
|
|
@@ -288,6 +288,7 @@ int io_futex_wait(struct io_kiocb *req,
|
|
goto done_unlock;
|
|
}
|
|
|
|
+ req->flags |= REQ_F_ASYNC_DATA;
|
|
req->async_data = ifd;
|
|
ifd->q = futex_q_init;
|
|
ifd->q.bitset = iof->futex_mask;
|
|
@@ -309,6 +310,8 @@ done:
|
|
if (ret < 0)
|
|
req_set_fail(req);
|
|
io_req_set_res(req, ret, 0);
|
|
+ req->async_data = NULL;
|
|
+ req->flags &= ~REQ_F_ASYNC_DATA;
|
|
kfree(ifd);
|
|
return IOU_COMPLETE;
|
|
}
|