io_uring: hold 'ctx' reference around task_work queue + execute
We're holding the request reference, but we need to go one higher to ensure that the ctx remains valid after the request has finished. If the ring is closed with pending task_work inflight, and the given io_kiocb finishes sync during issue, then we need a reference to the ring itself around the task_work execution cycle. Cc: stable@vger.kernel.org # v5.7+ Reported-by: <syzbot+9b260fc33297966f5a8e@syzkaller.appspotmail.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
Please register or sign in to comment