Re: [PATCH 1/2] io_uring: fix UAF for personality_idr

[Stefan Metzmacher <metze@xxxxxxxxx>]

Hi Matthew,

> -	ret = idr_alloc_cyclic(&ctx->personality_idr, (void *) creds, 1,
> -				USHRT_MAX, GFP_KERNEL);
> -	if (ret < 0)
> -		put_cred(creds);
> +	ret = xa_alloc_cyclic(&ctx->personalities, &id, (void *)creds,
> +			XA_LIMIT(0, USHRT_MAX), &ctx->pers_next, GFP_KERNEL);
> +	if (!ret)
> +		return id;
> +	put_cred(creds);
>  	return ret;

I guess this should be XA_LIMIT(1, USHRT_MAX) instead?
'0' should not be a valid id.

metze