diff options
| author | Jens Axboe <axboe@kernel.dk> | 2025-08-21 13:23:21 -0600 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-08-28 16:31:05 +0200 |
| commit | d9f93172820a53ab42c4b0e5e65291f4f9d00ad2 (patch) | |
| tree | 7c3a4ebc4a82c13a42e8679e5d26ccf39d8e3d8e | |
| parent | eb0abacdd3fce5a19fffc1c8bd0be6ffffeb59d8 (diff) | |
io_uring/futex: ensure io_futex_wait() cleans up properly on failure
commit 508c1314b342b78591f51c4b5dadee31a88335df upstream.
The io_futex_data is allocated upfront and assigned to the io_kiocb
async_data field, but the request isn't marked with REQ_F_ASYNC_DATA
at that point. Those two should always go together, as the flag tells
io_uring whether the field is valid or not.
Additionally, on failure cleanup, the futex handler frees the data but
does not clear ->async_data. Clear the data and the flag in the error
path as well.
Thanks to Trend Micro Zero Day Initiative and particularly ReDress for
reporting this.
Cc: stable@vger.kernel.org
Fixes: 194bb58c6090 ("io_uring: add support for futex wake and wait")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | io_uring/futex.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/io_uring/futex.c b/io_uring/futex.c index 01f044f89f8f..a3d2b700b480 100644 --- a/io_uring/futex.c +++ b/io_uring/futex.c @@ -337,6 +337,7 @@ int io_futex_wait(struct io_kiocb *req, unsigned int issue_flags) goto done_unlock; } + req->flags |= REQ_F_ASYNC_DATA; req->async_data = ifd; ifd->q = futex_q_init; ifd->q.bitset = iof->futex_mask; @@ -359,6 +360,8 @@ done: if (ret < 0) req_set_fail(req); io_req_set_res(req, ret, 0); + req->async_data = NULL; + req->flags &= ~REQ_F_ASYNC_DATA; kfree(ifd); return IOU_OK; } |