Description
In the Linux kernel, the following vulnerability has been resolved: io_uring/net: fix io_req_post_cqe abuse by send bundle [ 114.987980][ T5313] WARNING: CPU: 6 PID: 5313 at io_uring/io_uring.c:872 io_req_post_cqe+0x12e/0x4f0 [ 114.991597][ T5313] RIP: 0010:io_req_post_cqe+0x12e/0x4f0 [ 115.001880][ T5313] Call Trace: [ 115.002222][ T5313] <TASK> [ 115.007813][ T5313] io_send+0x4fe/0x10f0 [ 115.009317][ T5313] io_issue_sqe+0x1a6/0x1740 [ 115.012094][ T5313] io_wq_submit_work+0x38b/0xed0 [ 115.013223][ T5313] io_worker_handle_work+0x62a/0x1600 [ 115.013876][ T5313] io_wq_worker+0x34f/0xdf0 As the comment states, io_req_post_cqe() should only be used by multishot requests, i.e. REQ_F_APOLL_MULTISHOT, which bundled sends are not. Add a flag signifying whether a request wants to post multiple CQEs. Eventually REQ_F_APOLL_MULTISHOT should imply the new flag, but that's left out for simplicity.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
a05d1f625c7aa681d8816bc0f10089289ad07aad to < b7c6d081c19a5e11bbd77bb97a62cff2b6b21cb5affecteda05d1f625c7aa681d8816bc0f10089289ad07aad to < 7888c9fc0b2d3636f2e821ed1ad3c6920fa8e378affecteda05d1f625c7aa681d8816bc0f10089289ad07aad to < 9aa804e6b9696998308095fb9d335046a71550f1affecteda05d1f625c7aa681d8816bc0f10089289ad07aad to < 6889ae1b4df1579bcdffef023e2ea9a982565dffaffected
Linux Linux
Default version status: affected
6.10affected0 to < 6.10unaffected6.12.24 to ≤ 6.12.*unaffected6.13.12 to ≤ 6.13.*unaffected6.14.3 to ≤ 6.14.*unaffected6.15 to ≤ *unaffected