diff options
| author | Pavel Begunkov <asml.silence@gmail.com> | 2025-10-15 13:07:23 +0100 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2025-10-15 08:01:09 -0600 |
| commit | be7cab44ed099566c605a8dac686c3254db01b35 (patch) | |
| tree | a620e7c2fbf7229affbfaec3f87eb7dc04122848 | |
| parent | 927069c4ac2cd1a37efa468596fb5b8f86db9df0 (diff) | |
io_uring: protect mem region deregistration
io_create_region_mmap_safe() protects publishing of a region against
concurrent mmap calls, however we should also protect against it when
removing a region. There is a gap io_register_mem_region() where it
safely publishes a region, but then copy_to_user goes wrong and it
unsafely frees the region.
Cc: stable@vger.kernel.org
Fixes: 087f997870a94 ("io_uring/memmap: implement mmap for regions")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
| -rw-r--r-- | io_uring/register.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/io_uring/register.c b/io_uring/register.c index 43f04c47522c..58d43d624856 100644 --- a/io_uring/register.c +++ b/io_uring/register.c @@ -613,6 +613,7 @@ static int io_register_mem_region(struct io_ring_ctx *ctx, void __user *uarg) if (ret) return ret; if (copy_to_user(rd_uptr, &rd, sizeof(rd))) { + guard(mutex)(&ctx->mmap_lock); io_free_region(ctx, &ctx->param_region); return -EFAULT; } |