Commit 1d23a176 authored by Jens Axboe's avatar Jens Axboe Committed by Baokun Li
Browse files

io_uring/fdinfo: lock SQ thread while retrieving thread cpu/pid 

mainline inclusion
from mainline-v6.7
commit 7644b1a1
category: bugfix
bugzilla: 189322, https://gitee.com/src-openeuler/kernel/issues/I8BQSX
CVE: CVE-2023-46862

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7644b1a1c9a7ae8ab99175989bfc8676055edb46

--------------------------------

We could race with SQ thread exit, and if we do, we'll hit a NULL pointer
dereference when the thread is cleared. Grab the SQPOLL data lock before
attempting to get the task cpu and pid for fdinfo, this ensures we have a
stable view of it.

Cc: stable@vger.kernel.org
Link: https://bugzilla.kernel.org/show_bug.cgi?id=218032


Reviewed-by: default avatarGabriel Krisman Bertazi <krisman@suse.de>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>

Conflicts:
	io_uring/io_uring.c

Signed-off-by: default avatarBaokun Li <libaokun1@huawei.com>
parent c2ac271a

io_uring/io_uring.c

+12 −6
Original line number Diff line number Diff line
@@ -10180,7 +10180,7 @@ static int io_uring_show_cred(struct seq_file *m, unsigned int id, 


static void __io_uring_show_fdinfo(struct io_ring_ctx *ctx, struct seq_file *m)

{

	struct io_sq_data *sq = NULL;

	int sq_pid = -1, sq_cpu = -1;

	bool has_lock;

	int i;
@@ -10193,13 +10193,19 @@ static void __io_uring_show_fdinfo(struct io_ring_ctx *ctx, struct seq_file *m) 
	has_lock = mutex_trylock(&ctx->uring_lock);



	if (has_lock && (ctx->flags & IORING_SETUP_SQPOLL)) {

		sq = ctx->sq_data;

		if (!sq->thread)

			sq = NULL;

		struct io_sq_data *sq = ctx->sq_data;



		if (mutex_trylock(&sq->lock)) {

			if (sq->thread) {

				sq_pid = task_pid_nr(sq->thread);

				sq_cpu = task_cpu(sq->thread);

			}

			mutex_unlock(&sq->lock);

		}

	}



	seq_printf(m, "SqThread:\t%d\n", sq ? task_pid_nr(sq->thread) : -1);

	seq_printf(m, "SqThreadCpu:\t%d\n", sq ? task_cpu(sq->thread) : -1);

	seq_printf(m, "SqThread:\t%d\n", sq_pid);

	seq_printf(m, "SqThreadCpu:\t%d\n", sq_cpu);

	seq_printf(m, "UserFiles:\t%u\n", ctx->nr_user_files);

	for (i = 0; has_lock && i < ctx->nr_user_files; i++) {

		struct file *f = io_file_from_index(ctx, i);