[PATCH] io_uring: Fix NULL pointer dereference in loop_rw_iter()

: 06e0 Signed-off-by: Guoyu Huang --- fs/io_uring.c | 8 ++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/fs/io_uring.c b/fs/io_uring.c index 493e5047e67c..3c21e2e002b4 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -2661,8 +2661,10 @@ static int io_read(struct io_kiocb

[PATCH] io_uring: Fix NULL pointer dereference in loop_rw_write()

: 06e0 Signed-off-by: Guoyu Huang --- fs/io_uring.c | 8 ++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/fs/io_uring.c b/fs/io_uring.c index 493e5047e67c..3c21e2e002b4 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -2661,8 +2661,10 @@ static int io_read(struct io_kiocb

[PATCH] io_uring: Fix use-after-free in io_sq_wq_submit_work()

when ctx->sqo_mm is zero, io_sq_wq_submit_work() frees 'req' without deleting it from 'task_list'. After that, 'req' is accessed in io_ring_ctx_wait_and_kill() which lead to a use-after-free. Signed-off-by: Guoyu Huang --- fs/io_uring.c | 1 + 1 file changed, 1 insertion(+) diff --git a