io_uring/futex: ensure io_futex_wait() cleans up properly on failure

The io_futex_data is allocated upfront and assigned to the io_kiocb
async_data field, but the request isn't marked with REQ_F_ASYNC_DATA
at that point. Those two should always go together, as the flag tells
io_uring whether the field is valid or not.

Additionally, on failure cleanup, the futex handler frees the data but
does not clear ->async_data. Clear the data and the flag in the error
path as well.

Thanks to Trend Micro Zero Day Initiative and particularly ReDress for
reporting this.

Cc: stable@vger.kernel.org
Fixes: 194bb58c6090 ("io_uring: add support for futex wake and wait")
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/io_uring/futex.c b/io_uring/futex.c
index 692462d50c8c0c8eabfbcd75bf1323b0789f6031..9113a44984f3cb436049bbf05b778740894388b3 100644 (file)
--- a/io_uring/futex.c
+++ b/io_uring/futex.c
@@ -288,6 +288,7 @@ int io_futex_wait(struct io_kiocb *req, unsigned int issue_flags)
                goto done_unlock;
        }
 
+       req->flags |= REQ_F_ASYNC_DATA;
        req->async_data = ifd;
        ifd->q = futex_q_init;
        ifd->q.bitset = iof->futex_mask;
@@ -309,6 +310,8 @@ done:
        if (ret < 0)
                req_set_fail(req);
        io_req_set_res(req, ret, 0);
+       req->async_data = NULL;
+       req->flags &= ~REQ_F_ASYNC_DATA;
        kfree(ifd);
        return IOU_COMPLETE;
 }