Yang Xiuwei a89c34babc io_uring: fix incorrect io_kiocb reference in io_link_skb ...

[ Upstream commit 2c139a47ef ]

In io_link_skb function, there is a bug where prev_notif is incorrectly
assigned using 'nd' instead of 'prev_nd'. This causes the context
validation check to compare the current notification with itself instead
of comparing it with the previous notification.

Fix by using the correct prev_nd parameter when obtaining prev_notif.

Signed-off-by: Yang Xiuwei <yangxiuwei@kylinos.cn>
Reviewed-by: Pavel Begunkov <asml.silence@gmail.com>
Fixes: 6fe4220912 ("io_uring/notif: implement notification stacking")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2025-09-25 11:13:49 +02:00

..

advise.c

…

advise.h

…

alloc_cache.h

…

cancel.c

…

cancel.h

…

epoll.c

…

epoll.h

…

eventfd.c

io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period

2025-01-17 13:40:58 +01:00

eventfd.h

…

fdinfo.c

io_uring: fix use-after-free of sq->thread in __io_uring_show_fdinfo()

2025-06-19 15:32:33 +02:00

fdinfo.h

…

filetable.c

…

filetable.h

…

fs.c

…

fs.h

…

futex.c

io_uring/futex: ensure io_futex_wait() cleans up properly on failure

2025-08-28 16:31:05 +02:00

futex.h

…

io_uring.c

io_uring/msg_ring: kill alloc_cache for io_kiocb allocations

2025-09-25 11:13:48 +02:00

io_uring.h

io_uring: include dying ring in task_work "should cancel" state

2025-09-25 11:13:47 +02:00

io-wq.c

io_uring: fix task leak issue in io_wq_create()

2025-06-27 11:11:36 +01:00

io-wq.h

…

kbuf.c

io_uring/kbuf: flag partial buffer mappings

2025-07-06 11:01:48 +02:00

kbuf.h

io_uring/kbuf: drop WARN_ON_ONCE() from incremental length check

2025-09-25 11:13:48 +02:00

Makefile

…

memmap.c

…

memmap.h

…

msg_ring.c

io_uring/msg_ring: kill alloc_cache for io_kiocb allocations

2025-09-25 11:13:48 +02:00

msg_ring.h

…

napi.c

…

napi.h

…

net.c

io_uring/net: commit partial buffers on retry

2025-08-28 16:31:04 +02:00

net.h

…

nop.c

…

nop.h

…

notif.c

io_uring: fix incorrect io_kiocb reference in io_link_skb

2025-09-25 11:13:49 +02:00

notif.h

…

opdef.c

io_uring: make fallocate be hashed work

2025-07-17 18:37:21 +02:00

opdef.h

…

openclose.c

…

openclose.h

…

poll.c

io_uring: include dying ring in task_work "should cancel" state

2025-09-25 11:13:47 +02:00

poll.h

…

refs.h

io_uring: always do atomic put from iowq

2025-05-02 07:59:21 +02:00

register.c

io_uring: consistently use rcu semantics with sqpoll thread

2025-06-19 15:32:33 +02:00

register.h

…

rsrc.c

io_uring/rsrc: don't rely on user vaddr alignment

2025-07-06 11:01:47 +02:00

rsrc.h

io_uring/rsrc: don't rely on user vaddr alignment

2025-07-06 11:01:47 +02:00

rw.c

io_uring/rw: cast rw->flags assignment to rwf_t

2025-08-20 18:30:58 +02:00

rw.h

…

slist.h

…

splice.c

…

splice.h

…

sqpoll.c

io_uring/sqpoll: don't put task_struct on tctx setup failure

2025-06-27 11:11:42 +01:00

sqpoll.h

io_uring: consistently use rcu semantics with sqpoll thread

2025-06-19 15:32:33 +02:00

statx.c

…

statx.h

…

sync.c

…

sync.h

…

tctx.c

…

tctx.h

…

timeout.c

io_uring: include dying ring in task_work "should cancel" state

2025-09-25 11:13:47 +02:00

timeout.h

…

truncate.c

…

truncate.h

…

uring_cmd.c

io_uring: include dying ring in task_work "should cancel" state

2025-09-25 11:13:47 +02:00

uring_cmd.h

…

waitid.c

io_uring/waitid: don't abuse io_tw_state

2025-02-21 14:01:20 +01:00

waitid.h

…

xattr.c

…

xattr.h

…