diff options
| author | Pavel Begunkov <asml.silence@gmail.com> | 2022-09-26 14:35:09 +0100 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2022-09-26 08:36:50 -0600 |
| commit | 4c17a496a7a0730fdfc9e249b83cc58249111532 (patch) | |
| tree | b1b8ef69df833c6265c4cafdaf43d29b59cd7724 /io_uring/rw.c | |
| parent | aa1df3a360a0c50e0f0086a785d75c2785c29967 (diff) | |
io_uring/net: fix cleanup double free free_iov init
Having ->async_data doesn't mean it's initialised and previously we vere
relying on setting F_CLEANUP at the right moment. With zc sendmsg
though, we set F_CLEANUP early in prep when we alloc a notif and so we
may allocate async_data, fail in copy_msg_hdr() leaving
struct io_async_msghdr not initialised correctly but with F_CLEANUP
set, which causes a ->free_iov double free and probably other nastiness.
Always initialise ->free_iov. Also, now it might point to fast_iov when
fails, so avoid freeing it during cleanups.
Reported-by: syzbot+edfd15cd4246a3fc615a@syzkaller.appspotmail.com
Fixes: 493108d95f146 ("io_uring/net: zerocopy sendmsg")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'io_uring/rw.c')
0 files changed, 0 insertions, 0 deletions