Commit a1041c27 authored by Jackie Liu's avatar Jackie Liu Committed by Jens Axboe
Browse files

io_uring: fix potential crash issue due to io_get_req failure 



Sometimes io_get_req will return a NUL, then we need to do the
correct error handling, otherwise it will cause the kernel null
pointer exception.

Fixes: 4fe2c963 ("io_uring: add support for link with drain")
Signed-off-by: default avatarJackie Liu <liuyun01@kylinos.cn>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 6cc47d1d

fs/io_uring.c

+6 −0
Original line number Diff line number Diff line
@@ -2364,12 +2364,15 @@ static int io_submit_sqes(struct io_ring_ctx *ctx, struct sqe_submit *sqes, 
		if (link && (sqes[i].sqe->flags & IOSQE_IO_DRAIN)) {

			if (!shadow_req) {

				shadow_req = io_get_req(ctx, NULL);

				if (unlikely(!shadow_req))

					goto out;

				shadow_req->flags |= (REQ_F_IO_DRAIN | REQ_F_SHADOW_DRAIN);

				refcount_dec(&shadow_req->refs);

			}

			shadow_req->sequence = sqes[i].sequence;

		}



out:

		if (unlikely(mm_fault)) {

			io_cqring_add_event(ctx, sqes[i].sqe->user_data,

						-EFAULT);
@@ -2551,12 +2554,15 @@ static int io_ring_submit(struct io_ring_ctx *ctx, unsigned int to_submit, 
		if (link && (s.sqe->flags & IOSQE_IO_DRAIN)) {

			if (!shadow_req) {

				shadow_req = io_get_req(ctx, NULL);

				if (unlikely(!shadow_req))

					goto out;

				shadow_req->flags |= (REQ_F_IO_DRAIN | REQ_F_SHADOW_DRAIN);

				refcount_dec(&shadow_req->refs);

			}

			shadow_req->sequence = s.sequence;

		}



out:

		s.has_user = true;

		s.needs_lock = false;

		s.needs_fixed_file = false;

CRA Git | Maintained and supported by SUSTech CRA and CCSE