Re: [PATCH for-5.6] io_uring: fix use-after-free by io_cleanup_req()

[Pavel Begunkov <asml.silence@gmail.com>]

[-- Attachment #1.1: Type: text/plain, Size: 670 bytes --]

On 19/02/2020 03:13, Jens Axboe wrote:
> On 2/18/20 2:19 PM, Pavel Begunkov wrote:
>> io_cleanup_req() should be called before req->io is freed, and so
>> shouldn't be after __io_free_req() -> __io_req_aux_free(). Also,
>> it will be ignored for in io_free_req_many(), which use
>> __io_req_aux_free().
>>
>> Place cleanup_req() into __io_req_aux_free().
> 
> I've applied this, but would be great if you could generate 5.x
> patches against io_uring-5.x. This one didn't apply, as it's
> done behind some of the 5.7 series you have.
> 

Thanks, I cherry-picked it by didn't regenerate the patch.
I'll double check the next time

-- 
Pavel Begunkov


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]