From: Jiufei Xue <jiufei.xue@linux.alibaba.com>
Date: Wed, 2 Sep 2020 09:59:39 +0000 (+0800)
Subject: io_uring: set table->files[i] to NULL when io_sqe_file_register failed
X-Git-Tag: v5.8.8~33
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=329c9ffc81cfb985c6d131e94e6d220d7c1b19ca;p=thirdparty%2Fkernel%2Fstable.git

io_uring: set table->files[i] to NULL when io_sqe_file_register failed

commit 95d1c8e5f801e959a89181a2548a3efa60a1a6ce upstream.

While io_sqe_file_register() failed in __io_sqe_files_update(),
table->files[i] still point to the original file which may freed
soon, and that will trigger use-after-free problems.

Cc: stable@vger.kernel.org
Fixes: f3bd9dae3708 ("io_uring: fix memleak in __io_sqe_files_update()")
Signed-off-by: Jiufei Xue <jiufei.xue@linux.alibaba.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 4115bfedf15dc..5f6fdb100aec5 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -6957,6 +6957,7 @@ static int __io_sqe_files_update(struct io_ring_ctx *ctx,
 			table->files[index] = file;
 			err = io_sqe_file_register(ctx, file, i);
 			if (err) {
+				table->files[index] = NULL;
 				fput(file);
 				break;
 			}