io_uring/net: ensure vectored buffer node import is tied to notification

When support for vectored registered buffers was added, the import
itself is using 'req' rather than the notification io_kiocb, sr->notif.
For non-vectored imports, sr->notif is correctly used. This is important
as the lifetime of the two may be different. Use the correct io_kiocb
for the vectored buffer import.

Cc: stable@vger.kernel.org
Fixes: 23371eac7d9a ("io_uring/net: implement vectored reg bufs for zctx")
Reported-by: Google Big Sleep <big-sleep-vuln-reports+bigsleep-463332873@google.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/io_uring/net.c b/io_uring/net.c
index a95cc9ca2a4d88a2c95e5889a3410463d97ae9fe..43d77f95db51d9be2c69a5adfa597c0938ac7fa5 100644 (file)
--- a/io_uring/net.c
+++ b/io_uring/net.c
@@ -1532,8 +1532,10 @@ int io_sendmsg_zc(struct io_kiocb *req, unsigned int issue_flags)
                unsigned uvec_segs = kmsg->msg.msg_iter.nr_segs;
                int ret;
 
-               ret = io_import_reg_vec(ITER_SOURCE, &kmsg->msg.msg_iter, req,
-                                       &kmsg->vec, uvec_segs, issue_flags);
+               sr->notif->buf_index = req->buf_index;
+               ret = io_import_reg_vec(ITER_SOURCE, &kmsg->msg.msg_iter,
+                                       sr->notif, &kmsg->vec, uvec_segs,
+                                       issue_flags);
                if (unlikely(ret))
                        return ret;
                req->flags &= ~REQ_F_IMPORT_BUFFER;