diff options
| author | Jens Axboe <axboe@kernel.dk> | 2025-11-24 10:59:02 -0700 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2025-11-24 10:59:02 -0700 |
| commit | f6041803a831266a2a5a5b5af66f7de0845bcbf3 (patch) | |
| tree | 1eb3ddc1b354d0794fc4a8b3f712820bc7ff1d70 | |
| parent | 46447367a52965e9d35f112f5b26fc8ff8ec443d (diff) | |
| download | linux-f6041803a831266a2a5a5b5af66f7de0845bcbf3.tar.gz | |
io_uring/net: ensure vectored buffer node import is tied to notification
When support for vectored registered buffers was added, the import
itself is using 'req' rather than the notification io_kiocb, sr->notif.
For non-vectored imports, sr->notif is correctly used. This is important
as the lifetime of the two may be different. Use the correct io_kiocb
for the vectored buffer import.
Cc: stable@vger.kernel.org
Fixes: 23371eac7d9a ("io_uring/net: implement vectored reg bufs for zctx")
Reported-by: Google Big Sleep <big-sleep-vuln-reports+bigsleep-463332873@google.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
| -rw-r--r-- | io_uring/net.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/io_uring/net.c b/io_uring/net.c index a95cc9ca2a4d88..43d77f95db51d9 100644 --- a/io_uring/net.c +++ b/io_uring/net.c @@ -1532,8 +1532,10 @@ int io_sendmsg_zc(struct io_kiocb *req, unsigned int issue_flags) unsigned uvec_segs = kmsg->msg.msg_iter.nr_segs; int ret; - ret = io_import_reg_vec(ITER_SOURCE, &kmsg->msg.msg_iter, req, - &kmsg->vec, uvec_segs, issue_flags); + sr->notif->buf_index = req->buf_index; + ret = io_import_reg_vec(ITER_SOURCE, &kmsg->msg.msg_iter, + sr->notif, &kmsg->vec, uvec_segs, + issue_flags); if (unlikely(ret)) return ret; req->flags &= ~REQ_F_IMPORT_BUFFER; |