diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2025-12-26 11:34:38 -0800 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2025-12-26 11:34:38 -0800 |
| commit | 4079a38693910c44780b31cd3cbd220b4144e473 (patch) | |
| tree | cbd399192b1a8ad3c148055255381a48f87c7a7a /io_uring | |
| parent | 8f0cbedc86cfc93ea869bbff420a2d86f6373f57 (diff) | |
| parent | b14fad555302a2104948feaff70503b64c80ac01 (diff) | |
Merge tag 'io_uring-6.19-20251226' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull io_uring fix from Jens Axboe:
"Just a single fix for a bug that can cause a leak of the filename with
IORING_OP_OPENAT, if direct descriptors are asked for and O_CLOEXEC
has been set in the request flags"
* tag 'io_uring-6.19-20251226' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
io_uring: fix filename leak in __io_openat_prep()
Diffstat (limited to 'io_uring')
| -rw-r--r-- | io_uring/openclose.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/io_uring/openclose.c b/io_uring/openclose.c index bfeb91b31bba..15dde9bd6ff6 100644 --- a/io_uring/openclose.c +++ b/io_uring/openclose.c @@ -73,13 +73,13 @@ static int __io_openat_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe open->filename = NULL; return ret; } + req->flags |= REQ_F_NEED_CLEANUP; open->file_slot = READ_ONCE(sqe->file_index); if (open->file_slot && (open->how.flags & O_CLOEXEC)) return -EINVAL; open->nofile = rlimit(RLIMIT_NOFILE); - req->flags |= REQ_F_NEED_CLEANUP; if (io_openat_force_async(open)) req->flags |= REQ_F_FORCE_ASYNC; return 0; |