Guoyu Huang e8053c6833 io_uring: Fix use-after-free in io_sq_wq_submit_work()
when ctx->sqo_mm is zero, io_sq_wq_submit_work() frees 'req'
without deleting it from 'task_list'. After that, 'req' is
accessed in io_ring_ctx_wait_and_kill() which lead to
a use-after-free.

Signed-off-by: Guoyu Huang <hgy5945@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-08-11 15:33:33 +02:00
..
2019-09-27 15:10:34 -07:00
2020-06-30 15:37:02 -04:00
2019-09-19 09:42:37 -07:00
2020-06-24 17:50:26 +02:00
2020-08-07 09:34:02 +02:00
2020-07-29 10:18:28 +02:00
2019-09-19 09:42:37 -07:00
2019-09-19 09:42:37 -07:00
2019-07-03 17:52:09 -04:00
2019-09-19 09:42:37 -07:00
2020-06-17 16:40:24 +02:00
2020-03-05 16:43:36 +01:00
2019-08-07 21:51:47 -04:00
2020-03-25 08:25:58 +01:00
2019-12-17 19:55:30 +01:00
2019-09-18 16:59:14 -07:00
2019-09-18 16:59:14 -07:00
2020-05-06 08:15:15 +02:00
2019-08-01 20:51:23 +02:00