Jens Axboe 439a6728ec io_uring/kbuf: check if target buffer list is still legacy on recycle ...

Commit c2c185be5c upstream.

There's a gap between when the buffer was grabbed and when it
potentially gets recycled, where if the list is empty, someone could've
upgraded it to a ring provided type. This can happen if the request
is forced via io-wq. The legacy recycling is missing checking if the
buffer_list still exists, and if it's of the correct type. Add those
checks.

Cc: stable@vger.kernel.org
Fixes: c7fb19428d ("io_uring: add support for ring mapped supplied buffers")
Reported-by: Keenan Dong <keenanat2000@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2026-03-25 11:06:02 +01:00

..

advise.c

…

advise.h

…

alloc_cache.h

…

cancel.c

…

cancel.h

io_uring/cancel: de-unionize file and user_data in struct io_cancel_data

2026-03-04 07:20:15 -05:00

epoll.c

…

epoll.h

…

fdinfo.c

io_uring/fdinfo: annotate racy sq/cq head/tail reads

2025-06-04 14:42:16 +02:00

fdinfo.h

…

filetable.c

io_uring/filetable: clamp alloc_hint to the configured alloc range

2026-03-04 07:21:18 -05:00

filetable.h

…

fs.c

…

fs.h

…

io_uring.c

io_uring: move local task_work in exit cancel loop

2026-01-30 10:27:30 +01:00

io_uring.h

io_uring: include dying ring in task_work "should cancel" state

2025-09-25 11:00:09 +02:00

io-wq.c

io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop

2026-01-30 10:27:35 +01:00

io-wq.h

…

kbuf.c

io_uring/kbuf: check if target buffer list is still legacy on recycle

2026-03-25 11:06:02 +01:00

kbuf.h

io_uring/kbuf: use vm_insert_pages() for mmap'ed pbuf ring

2025-03-22 12:50:45 -07:00

Makefile

…

msg_ring.c

…

msg_ring.h

…

net.c

io_uring/net: commit partial buffers on retry

2025-08-28 16:28:11 +02:00

net.h

…

nop.c

…

nop.h

…

notif.c

…

notif.h

…

opdef.c

io_uring: make fallocate be hashed work

2025-07-17 18:35:20 +02:00

opdef.h

…

openclose.c

io_uring: fix filename leak in __io_openat_prep()

2026-01-11 15:21:54 +01:00

openclose.h

…

poll.c

io_uring/poll: correctly handle io_poll_add() return value on update

2026-01-11 15:22:03 +01:00

poll.h

…

refs.h

io_uring: always do atomic put from iowq

2025-05-02 07:50:57 +02:00

rsrc.c

io_uring: unify io_pin_pages()

2025-03-22 12:50:45 -07:00

rsrc.h

…

rw.c

io_uring/rw: fix wrong NOWAIT check in io_rw_init_file()

2025-06-19 15:28:45 +02:00

rw.h

…

slist.h

…

splice.c

…

splice.h

…

sqpoll.c

io_uring/sqpoll: fix sqpoll error handling races

2025-01-02 10:32:10 +01:00

sqpoll.h

…

statx.c

…

statx.h

…

sync.c

io_uring/sync: validate passed in offset

2026-03-04 07:19:27 -05:00

sync.h

…

tctx.c

…

tctx.h

…

timeout.c

io_uring: include dying ring in task_work "should cancel" state

2025-09-25 11:00:09 +02:00

timeout.h

…

uring_cmd.c

io_uring/uring_cmd: use cached cmd_op in io_uring_cmd_sock()

2025-02-08 09:52:33 +01:00

uring_cmd.h

…

xattr.c

…

xattr.h

…