diff options
| author | Pavel Begunkov <asml.silence@gmail.com> | 2026-04-21 09:47:04 +0100 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2026-04-21 12:19:11 -0600 |
| commit | 0fcccfd87152f957fa8312b841f6efef42a05a20 (patch) | |
| tree | abf0d104d4050181383b15538abe367e23a01741 /include/linux/stackprotector.h | |
| parent | 45cd95763e198d74d369ede43aef0b1955b8dea4 (diff) | |
io_uring/zcrx: fix user_struct uaf
io_free_rbuf_ring() usees a struct user_struct, which
io_zcrx_ifq_free() puts it down before destroying the ring.
Cc: stable@vger.kernel.org
Fixes: 5c686456a4e83 ("io_uring/zcrx: add user_struct and mm_struct to io_zcrx_ifq")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://patch.msgid.link/e560ae00960d27a810522a7efc0e201c82dff351.1776760917.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'include/linux/stackprotector.h')
0 files changed, 0 insertions, 0 deletions