]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
projects / thirdparty / kernel / linux.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 45cd957) | patch
io_uring/zcrx: fix user_struct uaf
authorPavel Begunkov <asml.silence@gmail.com>
Tue, 21 Apr 2026 08:47:04 +0000 (09:47 +0100)
committerJens Axboe <axboe@kernel.dk>
Tue, 21 Apr 2026 18:19:11 +0000 (12:19 -0600)
commit0fcccfd87152f957fa8312b841f6efef42a05a20
treeabf0d104d4050181383b15538abe367e23a01741tree | snapshot
parent45cd95763e198d74d369ede43aef0b1955b8dea4commit | diff
io_uring/zcrx: fix user_struct uaf

io_free_rbuf_ring() usees a struct user_struct, which
io_zcrx_ifq_free() puts it down before destroying the ring.

Cc: stable@vger.kernel.org
Fixes: 5c686456a4e83 ("io_uring/zcrx: add user_struct and mm_struct to io_zcrx_ifq")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://patch.msgid.link/e560ae00960d27a810522a7efc0e201c82dff351.1776760917.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
io_uring/zcrx.c diff | blob | blame | history
A mirror of Linus' kernel repository