On 4/27/21 6:51 AM, Palash Oswal wrote: > syzkaller identified KASAN: null-ptr-deref Write in > io_uring_cancel_sqpoll on v5.12 > > io_uring_cancel_sqpoll is called by io_sq_thread before calling > io_uring_alloc_task_context. This leads to current->io_uring being > NULL. io_uring_cancel_sqpoll should not have to deal with threads > where current->io_uring is NULL. > > In order to cast a wider safety net, perform input sanitisation > directly in io_uring_cancel_sqpoll and return for NULL value of > current->io_uring. Thanks applied - I augmented the commit message a bit. -- Jens Axboe
