]> git.proxmox.com Git - mirror_ubuntu-kernels.git/commit
io_uring: Convert personality_idr to XArray
authorMatthew Wilcox (Oracle) <willy@infradead.org>
Mon, 8 Mar 2021 14:16:16 +0000 (14:16 +0000)
committerJens Axboe <axboe@kernel.dk>
Wed, 10 Mar 2021 14:28:42 +0000 (07:28 -0700)
commit61cf93700fe6359552848ed5e3becba6cd760efa
tree52623012243a0159fab920d43f37e696fac2cbd4
parent0298ef969a110ca03654f0cea9b50e3f3b331acc
io_uring: Convert personality_idr to XArray

You can't call idr_remove() from within a idr_for_each() callback,
but you can call xa_erase() from an xa_for_each() loop, so switch the
entire personality_idr from the IDR to the XArray.  This manifests as a
use-after-free as idr_for_each() attempts to walk the rest of the node
after removing the last entry from it.

Fixes: 071698e13ac6 ("io_uring: allow registering credentials")
Cc: stable@vger.kernel.org # 5.6+
Reported-by: yangerkun <yangerkun@huawei.com>
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
[Pavel: rebased (creds load was moved into io_init_req())]
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/7ccff36e1375f2b0ebf73d957f037b43becc0dde.1615212806.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
fs/io_uring.c