Re: [PATCH 1/2] io_uring: fix UAF for personality_idr

[Matthew Wilcox <willy@xxxxxxxxxxxxx>]

On Mon, Mar 08, 2021 at 01:54:14PM +0000, Pavel Begunkov wrote:
> > +	ret = xa_alloc_cyclic(&ctx->personalities, &id, (void *)creds,
> > +			XA_LIMIT(0, USHRT_MAX), &ctx->pers_next, GFP_KERNEL);
> 
> ids are >=1, because 0 is kind of a reserved value for io_uring, so I guess
> 
> XA_LIMIT(1, USHRT_MAX)

+       xa_init_flags(&ctx->personalities, XA_FLAGS_ALLOC1);

takes care of not being able to allocate ID 0.