diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2026-07-19 09:24:32 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2026-07-19 09:24:32 -0700 |
| commit | a2b81de43ca64832fe09844bbf97d1251115d80f (patch) | |
| tree | ac05748a65f8004ceb908c08b8d8bb0b97dd2f42 /io_uring/fs.c | |
| parent | 8b752c85019958558972b75c8703caccd6fd7c47 (diff) | |
| parent | 3afc64c61ce906a04f073ca350b46de10e8302f9 (diff) | |
Merge tag 'io_uring-7.2-20260717' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull io_uring fixes from Jens Axboe:
- Fix a use-after-free in the bpf-ops struct_ops path, where the same
io_uring_bpf_ops map could be registered more than once.
- Fix the deferred iovec free for the provided-buffer grow path, which
could leave the caller with a dangling iovec and result in repeated
frees. Follow-up to the earlier fix in this series.
- Zero-check the unused addr3/pad2 SQE fields for unlinkat
* tag 'io_uring-7.2-20260717' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
io_uring/bpf-ops: reject re-registration of an already-bound ops
io_uring/fs: check unused sqe fields for unlinkat
io_uring/kbuf: free the replaced iovec after a successful grow
Diffstat (limited to 'io_uring/fs.c')
| -rw-r--r-- | io_uring/fs.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/io_uring/fs.c b/io_uring/fs.c index d0580c754bf8..26ea841a22e7 100644 --- a/io_uring/fs.c +++ b/io_uring/fs.c @@ -110,7 +110,8 @@ int io_unlinkat_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) const char __user *fname; int err; - if (sqe->off || sqe->len || sqe->buf_index || sqe->splice_fd_in) + if (sqe->off || sqe->len || sqe->buf_index || sqe->splice_fd_in || + sqe->addr3 || sqe->__pad2[0]) return -EINVAL; if (unlikely(req->flags & REQ_F_FIXED_FILE)) return -EBADF; |