io_uring/futex: ensure io_futex_wait() cleans up properly on failure

jira LE-4311
cve CVE-2025-39698
Rebuild_History Non-Buildable kernel-5.14.0-570.49.1.el9_6
commit-author Jens Axboe <axboe@kernel.dk>
commit 508c131

The io_futex_data is allocated upfront and assigned to the io_kiocb
async_data field, but the request isn't marked with REQ_F_ASYNC_DATA
at that point. Those two should always go together, as the flag tells
io_uring whether the field is valid or not.

Additionally, on failure cleanup, the futex handler frees the data but
does not clear ->async_data. Clear the data and the flag in the error
path as well.

Thanks to Trend Micro Zero Day Initiative and particularly ReDress for
reporting this.

	Cc: stable@vger.kernel.org
Fixes: 194bb58 ("io_uring: add support for futex wake and wait")
	Signed-off-by: Jens Axboe <axboe@kernel.dk>
(cherry picked from commit 508c131)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>

Author: PlaidCat

io_uring/futex.c

@@ -337,6 +337,7 @@ int io_futex_wait(struct io_kiocb *req, unsigned int issue_flags)
 		goto done_unlock;
 	}
 
+	req->flags |= REQ_F_ASYNC_DATA;
 	req->async_data = ifd;
 	ifd->q = futex_q_init;
 	ifd->q.bitset = iof->futex_mask;
@@ -359,6 +360,8 @@ int io_futex_wait(struct io_kiocb *req, unsigned int issue_flags)
 	if (ret < 0)
 		req_set_fail(req);
 	io_req_set_res(req, ret, 0);
+	req->async_data = NULL;
+	req->flags &= ~REQ_F_ASYNC_DATA;
 	kfree(ifd);
 	return IOU_OK;
 }