io_uring: fix potential use after free on fallback request free
authorPavel Begunkov <asml.silence@gmail.com>
Mon, 29 Jun 2020 10:13:03 +0000 (13:13 +0300)
committerJens Axboe <axboe@kernel.dk>
Tue, 30 Jun 2020 14:39:59 +0000 (08:39 -0600)
commitecfc51777487da4da530710e0b13de4c8cb4a6d2
tree60ebb91b5fb2e09fb274d9e0d8db2c47128029a6
parent8eb7e2d00763367f345ef0b2a2eb4f8001ae40ce
io_uring: fix potential use after free on fallback request free

After __io_free_req() puts a ctx ref, it should be assumed that the ctx
may already be gone. However, it can be accessed when putting the
fallback req. Free the req first and then put the ctx.

Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
fs/io_uring.c