lkml.org 
[lkml]   [2020]   [Aug]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH] fs/io_uring.c: Fix uninitialized variable is referenced in io_submit_sqe
From
Date
On 8/13/20 12:56 AM, Liu Yong wrote:
> the commit <a4d61e66ee4a> ("<io_uring: prevent re-read of sqe->opcode>")
> caused another vulnerability. After io_get_req(), the sqe_submit struct
> in req is not initialized, but the following code defaults that
> req->submit.opcode is available.

Thanks, I'll add this for 5.4-stable, it doesn't affect any kernels newer
than that.

--
Jens Axboe

\
 
 \ /
  Last update: 2020-08-13 16:56    [W:0.064 / U:1.200 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site