mirrors/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-12-27 10:01:39 -05:00
Code Issues Packages Projects Releases Wiki Activity

Merge tag 'io_uring-6.19-20251226' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

Browse Source 
Pull io_uring fix from Jens Axboe:
 "Just a single fix for a bug that can cause a leak of the filename with
  IORING_OP_OPENAT, if direct descriptors are asked for and O_CLOEXEC
  has been set in the request flags"

* tag 'io_uring-6.19-20251226' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  io_uring: fix filename leak in __io_openat_prep()
This commit is contained in:
Linus Torvalds
2025-12-26 11:34:38 -08:00
parent 8f0cbedc86 b14fad5553
commit 4079a38693
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
io_uring/openclose.c
View File

@@ -73,13 +73,13 @@ static int __io_openat_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe
open->filename = NULL; open->filename = NULL;
return ret; return ret;
} }
req->flags |= REQ_F_NEED_CLEANUP;
open->file_slot = READ_ONCE(sqe->file_index); open->file_slot = READ_ONCE(sqe->file_index);
if (open->file_slot && (open->how.flags & O_CLOEXEC)) if (open->file_slot && (open->how.flags & O_CLOEXEC))
return -EINVAL; return -EINVAL;
open->nofile = rlimit(RLIMIT_NOFILE); open->nofile = rlimit(RLIMIT_NOFILE);
req->flags |= REQ_F_NEED_CLEANUP;
if (io_openat_force_async(open)) if (io_openat_force_async(open))
req->flags |= REQ_F_FORCE_ASYNC; req->flags |= REQ_F_FORCE_ASYNC;
return 0; return 0;