Commit be7cab44 authored by Pavel Begunkov's avatar Pavel Begunkov Committed by Jens Axboe
Browse files

io_uring: protect mem region deregistration 



io_create_region_mmap_safe() protects publishing of a region against
concurrent mmap calls, however we should also protect against it when
removing a region. There is a gap io_register_mem_region() where it
safely publishes a region, but then copy_to_user goes wrong and it
unsafely frees the region.

Cc: stable@vger.kernel.org
Fixes: 087f9978 ("io_uring/memmap: implement mmap for regions")
Signed-off-by: default avatarPavel Begunkov <asml.silence@gmail.com>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 927069c4

io_uring/register.c

+1 −0
Original line number Diff line number Diff line
@@ -613,6 +613,7 @@ static int io_register_mem_region(struct io_ring_ctx *ctx, void __user *uarg) 
	if (ret)

		return ret;

	if (copy_to_user(rd_uptr, &rd, sizeof(rd))) {

		guard(mutex)(&ctx->mmap_lock);

		io_free_region(ctx, &ctx->param_region);

		return -EFAULT;

	}