Commit 4079a386 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'io_uring-6.19-20251226' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux 

Pull io_uring fix from Jens Axboe:
 "Just a single fix for a bug that can cause a leak of the filename with
  IORING_OP_OPENAT, if direct descriptors are asked for and O_CLOEXEC
  has been set in the request flags"

* tag 'io_uring-6.19-20251226' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  io_uring: fix filename leak in __io_openat_prep()
parents 8f0cbedc b14fad55

io_uring/openclose.c

+1 −1
Original line number Diff line number Diff line
@@ -73,13 +73,13 @@ static int __io_openat_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe 
		open->filename = NULL;

		return ret;

	}

	req->flags |= REQ_F_NEED_CLEANUP;



	open->file_slot = READ_ONCE(sqe->file_index);

	if (open->file_slot && (open->how.flags & O_CLOEXEC))

		return -EINVAL;



	open->nofile = rlimit(RLIMIT_NOFILE);

	req->flags |= REQ_F_NEED_CLEANUP;

	if (io_openat_force_async(open))

		req->flags |= REQ_F_FORCE_ASYNC;

	return 0;