Re: [PATCH 5.6] io_uring: NULL-deref for IOSQE_{ASYNC,DRAIN}

[Jens Axboe]

On 3/13/20 1:29 PM, Pavel Begunkov wrote:
> Processing links, io_submit_sqe() prepares requests, drops sqes, and
> passes them with sqe=NULL to io_queue_sqe(). There IOSQE_DRAIN and/or
> IOSQE_ASYNC requests will go through the same prep, which doesn't expect
> sqe=NULL and fail with NULL pointer deference.
> 
> Always do full prepare including io_alloc_async_ctx() for linked
> requests, and then it can skip the second preparation.

Thanks, applied.

-- 
Jens Axboe