Pavel Begunkov f1d96a8fcb io_uring: NULL-deref for IOSQE_{ASYNC,DRAIN}
Processing links, io_submit_sqe() prepares requests, drops sqes, and
passes them with sqe=NULL to io_queue_sqe(). There IOSQE_DRAIN and/or
IOSQE_ASYNC requests will go through the same prep, which doesn't expect
sqe=NULL and fail with NULL pointer deference.

Always do full prepare including io_alloc_async_ctx() for linked
requests, and then it can skip the second preparation.

Cc: stable@vger.kernel.org # 5.5
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2020-03-14 16:57:41 -06:00
..
2019-09-27 15:10:34 -07:00
2020-02-23 09:43:50 -08:00
2019-09-19 09:42:37 -07:00
2020-02-17 21:08:37 -08:00
2019-11-11 09:21:59 -05:00
2020-02-11 16:52:08 -08:00
2019-09-19 09:42:37 -07:00
2020-02-05 05:28:20 +00:00
2020-02-07 17:50:21 -08:00
\n
2020-01-30 15:37:41 -08:00
2019-09-19 09:42:37 -07:00
2020-01-14 13:28:28 -08:00
2020-02-11 16:52:08 -08:00
2020-02-26 16:58:15 +09:00
2020-02-05 20:34:32 -08:00
2019-08-07 21:51:47 -04:00
2020-01-29 19:38:34 -08:00
2020-02-07 14:48:35 -05:00
2020-02-07 14:48:35 -05:00
2020-01-29 18:53:37 -08:00
2020-02-08 13:44:41 -08:00
2020-02-09 15:51:46 -08:00
2020-02-09 15:51:46 -08:00
2020-02-01 10:36:49 -08:00
2020-02-03 21:23:33 -05:00
2020-02-04 11:45:21 +00:00
2019-12-08 14:37:36 +01:00