Commit 08480400 authored by Pavel Begunkov's avatar Pavel Begunkov Committed by Jens Axboe
Browse files

io_uring: fix leaking reg files on exit 



If io_sqe_files_unregister() faults on io_rsrc_ref_quiesce(), it will
fail to do unregister leaving files referenced. And that may well happen
because of a strayed signal or just because it does allocations inside.

In io_ring_ctx_free() do an unsafe version of unregister, as it's
guaranteed to not have requests by that point and so quiesce is useless.

Cc: stable@vger.kernel.org
Signed-off-by: default avatarPavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/e696e9eade571b51997d0dc1d01f144c6d685c05.1618278933.git.asml.silence@gmail.com


Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent f70865db

fs/io_uring.c

+15 −14
Original line number Diff line number Diff line
@@ -7089,6 +7089,10 @@ static void __io_sqe_files_unregister(struct io_ring_ctx *ctx) 
			fput(file);

	}

#endif

	io_free_file_tables(&ctx->file_table, ctx->nr_user_files);

	kfree(ctx->file_data);

	ctx->file_data = NULL;

	ctx->nr_user_files = 0;

}



static inline void io_rsrc_ref_lock(struct io_ring_ctx *ctx)
@@ -7195,21 +7199,14 @@ static struct io_rsrc_data *io_rsrc_data_alloc(struct io_ring_ctx *ctx, 


static int io_sqe_files_unregister(struct io_ring_ctx *ctx)

{

	struct io_rsrc_data *data = ctx->file_data;

	int ret;



	if (!data)

	if (!ctx->file_data)

		return -ENXIO;

	ret = io_rsrc_ref_quiesce(data, ctx);

	if (ret)

		return ret;



	ret = io_rsrc_ref_quiesce(ctx->file_data, ctx);

	if (!ret)

		__io_sqe_files_unregister(ctx);

	io_free_file_tables(&ctx->file_table, ctx->nr_user_files);

	kfree(data);

	ctx->file_data = NULL;

	ctx->nr_user_files = 0;

	return 0;

	return ret;

}



static void io_sq_thread_unpark(struct io_sq_data *sqd)
@@ -7659,7 +7656,7 @@ static int io_sqe_files_register(struct io_ring_ctx *ctx, void __user *arg, 


	ret = io_sqe_files_scm(ctx);

	if (ret) {

		io_sqe_files_unregister(ctx);

		__io_sqe_files_unregister(ctx);

		return ret;

	}
@@ -8460,7 +8457,11 @@ static void io_ring_ctx_free(struct io_ring_ctx *ctx) 
	}



	mutex_lock(&ctx->uring_lock);

	io_sqe_files_unregister(ctx);

	if (ctx->file_data) {

		if (!atomic_dec_and_test(&ctx->file_data->refs))

			wait_for_completion(&ctx->file_data->done);

		__io_sqe_files_unregister(ctx);

	}

	if (ctx->rings)

		__io_cqring_overflow_flush(ctx, true);

	mutex_unlock(&ctx->uring_lock);