• Jackie Liu's avatar
    io_uring: fix use-after-free of shadow_req · 5f5ad9ce
    Jackie Liu authored
    There is a potential dangling pointer problem. we never clean
    shadow_req, if there are multiple link lists in this series of
    sqes, then the shadow_req will not reallocate, and continue to
    use the last one. but in the previous, his memory has been
    released, thus forming a dangling pointer. let's clean up him
    and make sure that every new link list can reapply for a new
    shadow_req.
    
    Fixes: 4fe2c963 ("io_uring: add support for link with drain")
    Signed-off-by: default avatarJackie Liu <liuyun01@kylinos.cn>
    Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
    5f5ad9ce
io_uring.c 88.4 KB