Messages in this thread | | | Subject | Re: [PATCH] io_uring: Fix use-after-free in io_sq_wq_submit_work() | From | Jens Axboe <> | Date | Wed, 5 Aug 2020 13:10:54 -0600 |
| |
On 8/4/20 9:40 PM, Guoyu Huang wrote: > when ctx->sqo_mm is zero, io_sq_wq_submit_work() frees 'req' > without deleting it from 'task_list'. After that, 'req' is > accessed in io_ring_ctx_wait_and_kill() which lead to > a use-after-free.
This looks like an old one, that affects 5.4 only. I've massaged it to apply on top of another fix, will ask to get it queued up for stable. Thanks!
-- Jens Axboe
| |