Rahat Mahmood and gVisor bot
3c0e0a3746
io_uring: Fix several issues with shared ring buffers.
...
- Don't use params stored in the shared buffers because they're
modifiable by userspace. Instead, keep a private copy of these
params for sentry use.
- The ring pointers were being copied and polled incorrectly. Instead
of marshalling the various head/tail pointers, load them directly
from the shared memory regions.
- Restructure mapping and marshalling code.
Reported-by: syzbot+ed041382441c65be76a3@syzkaller.appspotmail.com
Reported-by: syzbot+be78f32e26e862cca391@syzkaller.appspotmail.com
Reported-by: syzbot+97b5b9af7db8a967fa24@syzkaller.appspotmail.com
Reported-by: syzbot+6b831509e7b43bdb5788@syzkaller.appspotmail.com
PiperOrigin-RevId: 489281803
2022-11-17 12:45:32 -08:00