io_uring: add missing lock in io_get_file_fixed
io_get_file_fixed will access io_uring's context. Lock it if it is
invoked unlocked (eg via io-wq) to avoid a race condition with fixed
files getting unregistered.
No single upstream patch exists for this issue, it was fixed as part
of the file assignment changes that went into the 5.18 cycle.
BUG=b/277048957,b/277623285
TEST=presubmit,validation
RELEASE_NOTE=Fixed race condition in io_uring in the Linux kernel.
Signed-off-by: Jheng, Bing-Jhong Billy <billy@starlabs.sg>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
cos-patch: security-moderate
Change-Id: Ic723f1e66b5c0b4a3b8cfb9548bcc9465ce02fed
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/46467
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
Reviewed-by: Vaibhav Rustagi <vaibhavrustagi@google.com>
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/46927
1 file changed
