io_uring: fix race between timeout flush and removal
commit e677edbcabee849bfdd43f1602bccbecf736a646 upstream.
io_flush_timeouts() assumes the timeout isn't in progress of triggering
or being removed/canceled, so it unconditionally removes it from the
timeout list and attempts to cancel it.
Leave it on the list and let the normal timeout cancelation take care
of it.
Cc: stable@vger.kernel.org # 5.5+
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 2827328e646d0c2d3db1bfcad4b5f5016ce0d643)
Signed-off-by: Robert Kolchmeyer <rkolchmeyer@google.com>
BUG=b/230111641
TEST=presubmit
RELEASE_NOTE=Fixed CVE-2022-29580 in the Linux kernel.
cos-patch: security-high
Change-Id: I3a67ac34e0e5a03d6efb0f1d51f87bb93fca885b
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/32084
Reviewed-by: Roy Yang <royyang@google.com>
Reviewed-by: Oleksandr Tymoshenko <ovt@google.com>
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
1 file changed
