Commit 66e4b110 authored by Pavel Begunkov's avatar Pavel Begunkov Committed by Yifan Qiao
Browse files

io_uring: check if iowq is killed before queuing 

stable inclusion
from stable-v6.6.68
commit 2ca94c8de36091067b9ce7527ae8db3812d38781
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEG43
CVE: CVE-2024-56709

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=2ca94c8de36091067b9ce7527ae8db3812d38781



--------------------------------

commit dbd2ca9367eb19bc5e269b8c58b0b1514ada9156 upstream.

task work can be executed after the task has gone through io_uring
termination, whether it's the final task_work run or the fallback path.
In this case, task work will find ->io_wq being already killed and
null'ed, which is a problem if it then tries to forward the request to
io_queue_iowq(). Make io_queue_iowq() fail requests in this case.

Note that it also checks PF_KTHREAD, because the user can first close
a DEFER_TASKRUN ring and shortly after kill the task, in which case
->iowq check would race.

Cc: stable@vger.kernel.org
Fixes: 50c52250e2d74 ("block: implement async io_uring discard cmd")
Fixes: 773af691 ("io_uring: always reissue from task_work context")
Reported-by: default avatarWill <willsroot@protonmail.com>
Signed-off-by: default avatarPavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/63312b4a2c2bb67ad67b857d17a300e1d3b078e8.1734637909.git.asml.silence@gmail.com


Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarYifan Qiao <qiaoyifan4@huawei.com>
parent 345ca570

io_uring/io_uring.c

+6 −1
Original line number Diff line number Diff line
@@ -1096,6 +1096,7 @@ static struct file *io_file_get(struct io_ring_ctx *ctx, 
				unsigned int issue_flags);

static void __io_queue_sqe(struct io_kiocb *req);

static void io_rsrc_put_work(struct work_struct *work);

static void io_req_task_queue_fail(struct io_kiocb *req, int ret);



static void io_req_task_queue(struct io_kiocb *req);

static void io_submit_flush_completions(struct io_ring_ctx *ctx);
@@ -1465,7 +1466,11 @@ static void io_queue_async_work(struct io_kiocb *req, bool *locked) 
	locked = NULL;



	BUG_ON(!tctx);

	BUG_ON(!tctx->io_wq);



	if ((current->flags & PF_KTHREAD) || !tctx->io_wq) {

		io_req_task_queue_fail(req, -ECANCELED);

		return;

	}



	/* init ->work of the whole link before punting */

	io_prep_async_link(req);