Merge tag 'io_uring-5.8-2020-07-17' of git://git.kernel.dk/linux-block into master

Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

kernel os linux

Pull io_uring fix from Jens Axboe:
"Fix for a case where, with automatic buffer selection, we can leak the
buffer descriptor for recvmsg"

* tag 'io_uring-5.8-2020-07-17' of git://git.kernel.dk/linux-block:
io_uring: fix recvmsg memory leak with buffer selection

Linus Torvalds 5 years ago 4ebf8d76 c9ea87dc

+8 -2

1 changed file

expand all

io_uring.c

+8 -2

fs/io_uring.c

··· 3845 3845 3846 3846 ret = __sys_recvmsg_sock(sock, &kmsg->msg, req->sr_msg.msg, 3847 3847 kmsg->uaddr, flags); 3848 - if (force_nonblock && ret == -EAGAIN) 3849 - return io_setup_async_msg(req, kmsg); 3848 + if (force_nonblock && ret == -EAGAIN) { 3849 + ret = io_setup_async_msg(req, kmsg); 3850 + if (ret != -EAGAIN) 3851 + kfree(kbuf); 3852 + return ret; 3853 + } 3850 3854 if (ret == -ERESTARTSYS) 3851 3855 ret = -EINTR; 3856 + if (kbuf) 3857 + kfree(kbuf); 3852 3858 } 3853 3859 3854 3860 if (kmsg && kmsg->iov != kmsg->fast_iov)