Merge: CVE-2025-39698: io_uring/futex: ensure io_futex_wait() cleans up properly on failure

MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/1432

JIRA: https://issues.redhat.com/browse/RHEL-114339
CVE: CVE-2025-39698

```
commit 508c131
Author: Jens Axboe <axboe@kernel.dk>
Date:   Thu Aug 21 13:23:21 2025 -0600

    io_uring/futex: ensure io_futex_wait() cleans up properly on failure

    The io_futex_data is allocated upfront and assigned to the io_kiocb
    async_data field, but the request isn't marked with REQ_F_ASYNC_DATA
    at that point. Those two should always go together, as the flag tells
    io_uring whether the field is valid or not.

    Additionally, on failure cleanup, the futex handler frees the data but
    does not clear ->async_data. Clear the data and the flag in the error
    path as well.

    Thanks to Trend Micro Zero Day Initiative and particularly ReDress for
    reporting this.

    Cc: stable@vger.kernel.org
    Fixes: 194bb58 ("io_uring: add support for futex wake and wait")
    Signed-off-by: Jens Axboe <axboe@kernel.dk>
```

Signed-off-by: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com>

---

<small>Created 2025-09-12 01:50 UTC by backporter - [KWF FAQ](https://red.ht/kernel_workflow_doc) - [Slack #team-kernel-workflow](https://redhat-internal.slack.com/archives/C04LRUPMJQ5) - [Source](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/webhook/utils/backporter.py) - [Documentation](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/docs/README.backporter.md) - [Report an issue](https://issues.redhat.com/secure/CreateIssueDetails!init.jspa?pid=12334433&issuetype=1&priority=4&summary=backporter+webhook+issue&components=kernel-workflow+/+backporter)</small>

Approved-by: Jeff Moyer <jmoyer@redhat.com>
Approved-by: Brian Foster <bfoster@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>

Author: CKI KWF Bot

io_uring/futex.c

@@ -288,6 +288,7 @@ int io_futex_wait(struct io_kiocb *req, unsigned int issue_flags)
 		goto done_unlock;
 	}
 
+	req->flags |= REQ_F_ASYNC_DATA;
 	req->async_data = ifd;
 	ifd->q = futex_q_init;
 	ifd->q.bitset = iof->futex_mask;
@@ -310,6 +311,8 @@ int io_futex_wait(struct io_kiocb *req, unsigned int issue_flags)
 	if (ret < 0)
 		req_set_fail(req);
 	io_req_set_res(req, ret, 0);
+	req->async_data = NULL;
+	req->flags &= ~REQ_F_ASYNC_DATA;
 	kfree(ifd);
 	return IOU_OK;
 }