Jens Axboe a7b33671e4 io_uring/kbuf: check if target buffer list is still legacy on recycle ...

Commit c2c185be5c upstream.

There's a gap between when the buffer was grabbed and when it
potentially gets recycled, where if the list is empty, someone could've
upgraded it to a ring provided type. This can happen if the request
is forced via io-wq. The legacy recycling is missing checking if the
buffer_list still exists, and if it's of the correct type. Add those
checks.

Cc: stable@vger.kernel.org
Fixes: c7fb19428d ("io_uring: add support for ring mapped supplied buffers")
Reported-by: Keenan Dong <keenanat2000@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2026-03-25 11:03:12 +01:00

..

advise.c

…

advise.h

…

alloc_cache.h

…

cancel.c

io_uring/cancel: support opcode based lookup and cancelation

2026-03-04 07:20:02 -05:00

cancel.h

io_uring/cancel: de-unionize file and user_data in struct io_cancel_data

2026-03-04 07:20:02 -05:00

epoll.c

…

epoll.h

…

fdinfo.c

io_uring/fdinfo: annotate racy sq/cq head/tail reads

2025-06-04 14:40:18 +02:00

fdinfo.h

…

filetable.c

io_uring/filetable: clamp alloc_hint to the configured alloc range

2026-03-04 07:20:54 -05:00

filetable.h

…

fs.c

…

fs.h

…

io_uring.c

io_uring: move local task_work in exit cancel loop

2026-02-06 16:44:02 +01:00

io_uring.h

io_uring: include dying ring in task_work "should cancel" state

2025-09-25 10:58:53 +02:00

io-wq.c

io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop

2026-03-25 11:03:11 +01:00

io-wq.h

…

kbuf.c

io_uring/kbuf: check if target buffer list is still legacy on recycle

2026-03-25 11:03:12 +01:00

kbuf.h

…

Makefile

…

msg_ring.c

…

msg_ring.h

…

net.c

io_uring/poll: fix POLLERR handling

2025-07-24 08:51:48 +02:00

net.h

…

nop.c

io_uring: fail NOP if non-zero op flags is passed in

2024-06-12 11:02:55 +02:00

nop.h

…

notif.c

…

notif.h

…

opdef.c

…

opdef.h

…

openclose.c

io_uring: fix filename leak in __io_openat_prep()

2026-01-11 15:18:56 +01:00

openclose.h

…

poll.c

io_uring/cancel: support opcode based lookup and cancelation

2026-03-04 07:20:02 -05:00

poll.h

…

refs.h

…

rsrc.c

…

rsrc.h

…

rw.c

io_uring/rw: commit provided buffer state on async

2025-02-21 13:49:53 +01:00

rw.h

…

slist.h

…

splice.c

…

splice.h

…

sqpoll.c

io_uring/sqpoll: fix sqpoll error handling races

2025-01-02 10:30:54 +01:00

sqpoll.h

…

statx.c

…

statx.h

…

sync.c

io_uring/sync: validate passed in offset

2026-03-04 07:19:24 -05:00

sync.h

…

tctx.c

io_uring/tctx: work around xa_store() allocation error issue

2024-12-14 19:54:49 +01:00

tctx.h

…

timeout.c

io_uring: include dying ring in task_work "should cancel" state

2025-09-25 10:58:53 +02:00

timeout.h

…

uring_cmd.c

…

uring_cmd.h

…

xattr.c

…

xattr.h

…