This is a note to let you know that I've just added the patch titled io_uring: ensure open/openat2 name is cleaned on cancelation to the 5.8-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: io_uring-ensure-open-openat2-name-is-cleaned-on-cancelation.patch and it can be found in the queue-5.8 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From f3cd4850504ff612d0ea77a0aaf29b66c98fcefe Mon Sep 17 00:00:00 2001 From: Jens Axboe <axboe@xxxxxxxxx> Date: Thu, 24 Sep 2020 14:55:54 -0600 Subject: io_uring: ensure open/openat2 name is cleaned on cancelation From: Jens Axboe <axboe@xxxxxxxxx> commit f3cd4850504ff612d0ea77a0aaf29b66c98fcefe upstream. If we cancel these requests, we'll leak the memory associated with the filename. Add them to the table of ops that need cleaning, if REQ_F_NEED_CLEANUP is set. Cc: stable@xxxxxxxxxxxxxxx Fixes: e62753e4e292 ("io_uring: call statx directly") Reviewed-by: Stefano Garzarella <sgarzare@xxxxxxxxxx> Signed-off-by: Jens Axboe <axboe@xxxxxxxxx> Signed-off-by: Stefano Garzarella <sgarzare@xxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- fs/io_uring.c | 2 ++ 1 file changed, 2 insertions(+) --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -5254,6 +5254,8 @@ static void io_cleanup_req(struct io_kio break; case IORING_OP_OPENAT: case IORING_OP_OPENAT2: + if (req->open.filename) + putname(req->open.filename); break; case IORING_OP_SPLICE: case IORING_OP_TEE: Patches currently in stable-queue which might be from axboe@xxxxxxxxx are queue-5.8/io_uring-ensure-open-openat2-name-is-cleaned-on-cancelation.patch queue-5.8/s390-dasd-fix-zero-write-for-fba-devices.patch queue-5.8/io_uring-fix-openat-openat2-unified-prep-handling.patch