io_uring: add missing lock in io_get_file_fixed
io_get_file_fixed will access io_uring's context. Lock it if it is
invoked unlocked (eg via io-wq) to avoid a race condition with fixed
files getting unregistered.
No single upstream patch exists for this issue, it was fixed as part
of the file assignment changes that went into the 5.18 cycle.
BUG=b/277048957,b/277623506
TEST=presubmit,validation
RELEASE_NOTE=Fixed race condition in io_uring in the Linux kernel.
Signed-off-by: Jheng, Bing-Jhong Billy <billy@starlabs.sg>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
cos-patch: security-moderate
Change-Id: Ib6e6dae5827c9cef2a8085e8b56b75534cad44c9
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/46357
Tested-by: Meena Shanmugam <meenashanmugam@google.com>
Reviewed-by: Oleksandr Tymoshenko <ovt@google.com>
Main-Branch-Verified: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
1 file changed
