io_uring/zcrx: fix user_struct uaf

io_free_rbuf_ring() usees a struct user_struct, which
io_zcrx_ifq_free() puts it down before destroying the ring.

Cc: stable@vger.kernel.org
Fixes: 5c686456a4e83 ("io_uring/zcrx: add user_struct and mm_struct to io_zcrx_ifq")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://patch.msgid.link/e560ae00960d27a810522a7efc0e201c82dff351.1776760917.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c
index 9a83d7eb4210e292be210e7a9eb463c607a815a7..fab3693ecb0d61434f0d210ae8502bf5af3e8b4c 100644 (file)
--- a/io_uring/zcrx.c
+++ b/io_uring/zcrx.c
@@ -579,13 +579,13 @@ static void io_zcrx_ifq_free(struct io_zcrx_ifq *ifq)
 
        if (ifq->area)
                io_zcrx_free_area(ifq, ifq->area);
-       free_uid(ifq->user);
        if (ifq->mm_account)
                mmdrop(ifq->mm_account);
        if (ifq->dev)
                put_device(ifq->dev);
 
        io_free_rbuf_ring(ifq);
+       free_uid(ifq->user);
        mutex_destroy(&ifq->pp_lock);
        kfree(ifq);
 }