github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 09:36:22 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

io_uring-7.2-20260717

Browse Source 
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmpbBbsQHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgpgpFD/9NnN5A9eMm+4ZeC41yeynykN1QOl5wCqoT
 zi7CIizuwtsCQAjgpFUahMosvkLg3P77S/MJxqzlGVPhaSvp/QISxr7oH9WqyoYf
 jEfi3Dx8XfdxK+5GG0dC7s4iiWuxZha7iGt4W2DZmjXWWu0ofCKB0FTVK7J/AkC0
 7DA4hMmts643cE9pwmD1Bbuj7SYmqjneDhgwe/JaSuCiuuclN5L359E1rnxzc+dS
 9McCmwPjwF0f+Vs9IWyHb1KNMBBmC2T0n2zvzKoJKL72mQ0v3IaOlGkUEDgp7EpT
 TIK5rEKPl/Wpw970BOlzdYgD01vDiWeLuQQQlGfAaLheUUImLoFPo1rf/q8nCgFN
 CVEWDSZZWRnwH6FjFCa5JwOS0B9YcamYzhkTck1O+g7KcNB6ZCU1zMX8+pCMEVgr
 Ju5J2uoazT2txEZEgCSSUYLuRRSpz5P5s/VmFEXNxeRAhndlGhyNq16kVnRqyLfA
 OzVS5uYeqSOlOYbY8pL4QkGaxBUr0CSBOnhCT7q9d8KYXnh9CHReFQcy9wPclSfd
 D+F5v4CPqWN0tg2rrYBgo3Zpt4Mwb1JEiyOAaIapAKQT2T9tNtp1fubq4PA9c1ub
 VkSRutPGeUWNC1fEjs67I9V3V0bzbR8j+AMC9AAFFqaqpn2B5NGHqvlcYdaNuuje
 Dr7yXvROWw==
 =Ue52
 -----END PGP SIGNATURE-----

Merge tag 'io_uring-7.2-20260717' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

Pull io_uring fixes from Jens Axboe:

 - Fix a use-after-free in the bpf-ops struct_ops path, where the same
   io_uring_bpf_ops map could be registered more than once.

 - Fix the deferred iovec free for the provided-buffer grow path, which
   could leave the caller with a dangling iovec and result in repeated
   frees. Follow-up to the earlier fix in this series.

 - Zero-check the unused addr3/pad2 SQE fields for unlinkat

* tag 'io_uring-7.2-20260717' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  io_uring/bpf-ops: reject re-registration of an already-bound ops
  io_uring/fs: check unused sqe fields for unlinkat
  io_uring/kbuf: free the replaced iovec after a successful grow
This commit is contained in:
Linus Torvalds 2026-07-19 09:24:32 -07:00
commit a2b81de43c
3 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
io_uring/bpf-ops.c
View File

@ -168,6 +168,8 @@ static int io_install_bpf(struct io_ring_ctx *ctx, struct io_uring_bpf_ops *ops)
if (ctx->bpf_ops)
return -EBUSY;
if (ops->priv)
return -EBUSY;
if (WARN_ON_ONCE(!ops->loop_step))
return -EINVAL;

3
io_uring/fs.c
View File

@ -110,7 +110,8 @@ int io_unlinkat_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
const char __user *fname;
int err;
if (sqe->off || sqe->len || sqe->buf_index || sqe->splice_fd_in)
if (sqe->off || sqe->len || sqe->buf_index || sqe->splice_fd_in ||
sqe->addr3 || sqe->__pad2[0])
return -EINVAL;
if (unlikely(req->flags & REQ_F_FIXED_FILE))
return -EBADF;

4
io_uring/kbuf.c
View File

@ -328,8 +328,8 @@ static int io_ring_buffers_peek(struct io_kiocb *req, struct buf_sel_arg *arg,
buf = io_ring_head_to_buf(br, ++head, bl->mask);
} while (--nr_iovs);
if (arg->mode & KBUF_MODE_FREE)
kfree(arg->iovs);
if (arg->iovs != org_iovs && (arg->mode & KBUF_MODE_FREE))
kfree(org_iovs);
if (head == tail)
req->flags |= REQ_F_BL_EMPTY;