From: Jens Axboe <axboe@kernel.dk>
To: io-uring@vger.kernel.org, Pavel Begunkov <asml.silence@gmail.com>
Cc: syzbot+4c597a574a3f5a251bda@syzkaller.appspotmail.com,
Dylan Yudaken <dylany@fb.com>
Subject: Re: [PATCH for-next v2] io_uring/net: fix UAF in io_sendrecv_fail()
Date: Fri, 23 Sep 2022 15:01:37 -0600 [thread overview]
Message-ID: <166396689732.501295.6133053172060679848.b4-ty@kernel.dk> (raw)
In-Reply-To: <23ab8346e407ea50b1198a172c8a97e1cf22915b.1663945875.git.asml.silence@gmail.com>
On Fri, 23 Sep 2022 16:23:34 +0100, Pavel Begunkov wrote:
> We should not assume anything about ->free_iov just from
> REQ_F_ASYNC_DATA but rather rely on REQ_F_NEED_CLEANUP, as we may
> allocate ->async_data but failed init would leave the field in not
> consistent state. The easiest solution is to remove removing
> REQ_F_NEED_CLEANUP and so ->async_data dealloc from io_sendrecv_fail()
> and let io_send_zc_cleanup() do the job. The catch here is that we also
> need to prevent double notif flushing, just test it for NULL and zero
> where it's needed.
>
> [...]
Applied, thanks!
[1/1] io_uring/net: fix UAF in io_sendrecv_fail()
commit: a75155faef4efcb9791f77e2652e29ce8906e05a
Best regards,
--
Jens Axboe
prev parent reply other threads:[~2022-09-23 21:02 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-09-23 15:23 [PATCH for-next v2] io_uring/net: fix UAF in io_sendrecv_fail() Pavel Begunkov
2022-09-23 21:01 ` Jens Axboe [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=166396689732.501295.6133053172060679848.b4-ty@kernel.dk \
--to=axboe@kernel.dk \
--cc=asml.silence@gmail.com \
--cc=dylany@fb.com \
--cc=io-uring@vger.kernel.org \
--cc=syzbot+4c597a574a3f5a251bda@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.