Commit f6041803 authored by Jens Axboe's avatar Jens Axboe
Browse files

io_uring/net: ensure vectored buffer node import is tied to notification 



When support for vectored registered buffers was added, the import
itself is using 'req' rather than the notification io_kiocb, sr->notif.
For non-vectored imports, sr->notif is correctly used. This is important
as the lifetime of the two may be different. Use the correct io_kiocb
for the vectored buffer import.

Cc: stable@vger.kernel.org
Fixes: 23371eac ("io_uring/net: implement vectored reg bufs for zctx")
Reported-by: default avatarGoogle Big Sleep <big-sleep-vuln-reports+bigsleep-463332873@google.com>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 46447367

io_uring/net.c

+4 −2
Original line number Diff line number Diff line
@@ -1532,8 +1532,10 @@ int io_sendmsg_zc(struct io_kiocb *req, unsigned int issue_flags) 
		unsigned uvec_segs = kmsg->msg.msg_iter.nr_segs;

		int ret;



		ret = io_import_reg_vec(ITER_SOURCE, &kmsg->msg.msg_iter, req,

					&kmsg->vec, uvec_segs, issue_flags);

		sr->notif->buf_index = req->buf_index;

		ret = io_import_reg_vec(ITER_SOURCE, &kmsg->msg.msg_iter,

					sr->notif, &kmsg->vec, uvec_segs,

					issue_flags);

		if (unlikely(ret))

			return ret;

		req->flags &= ~REQ_F_IMPORT_BUFFER;