io_uring: ensure open/openat2 name is cleaned on cancelation

commit f3cd4850504ff612d0ea77a0aaf29b66c98fcefe upstream.

If we cancel these requests, we'll leak the memory associated with the
filename. Add them to the table of ops that need cleaning, if
REQ_F_NEED_CLEANUP is set.

Cc: stable@vger.kernel.org
Fixes: e62753e4e292 ("io_uring: call statx directly")
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 849e39c3cfcd775461b4e2c9c74503dc0093ee45..1d5640cc2a488c506566d43fcecf69324ecb4627 100644 (file)
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -5254,6 +5254,8 @@ static void io_cleanup_req(struct io_kiocb *req)
                break;
        case IORING_OP_OPENAT:
        case IORING_OP_OPENAT2:
+               if (req->open.filename)
+                       putname(req->open.filename);
                break;
        case IORING_OP_SPLICE:
        case IORING_OP_TEE: