diff options
| author | Jens Axboe <[email protected]> | 2025-08-21 19:23:21 +0000 |
|---|---|---|
| committer | Jens Axboe <[email protected]> | 2025-08-21 19:53:33 +0000 |
| commit | 508c1314b342b78591f51c4b5dadee31a88335df (patch) | |
| tree | 0dcab768c97d040f0a748ed717fe66b73b69253f /io_uring/io_uring.c | |
| parent | io_uring/io-wq: add check free worker before create new worker (diff) | |
| download | kernel-508c1314b342b78591f51c4b5dadee31a88335df.tar.gz kernel-508c1314b342b78591f51c4b5dadee31a88335df.zip | |
io_uring/futex: ensure io_futex_wait() cleans up properly on failure
The io_futex_data is allocated upfront and assigned to the io_kiocb
async_data field, but the request isn't marked with REQ_F_ASYNC_DATA
at that point. Those two should always go together, as the flag tells
io_uring whether the field is valid or not.
Additionally, on failure cleanup, the futex handler frees the data but
does not clear ->async_data. Clear the data and the flag in the error
path as well.
Thanks to Trend Micro Zero Day Initiative and particularly ReDress for
reporting this.
Cc: [email protected]
Fixes: 194bb58c6090 ("io_uring: add support for futex wake and wait")
Signed-off-by: Jens Axboe <[email protected]>
Diffstat (limited to 'io_uring/io_uring.c')
0 files changed, 0 insertions, 0 deletions