Commit a5edf315 authored by Jens Axboe's avatar Jens Axboe Committed by Wen Zhiwei
Browse files

io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period 

stable inclusion
from stable-v6.6.72
commit 8efff2aa2d95dc437ab67c5b4a9f1d3f367baa10
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/IBQN9L

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=8efff2aa2d95dc437ab67c5b4a9f1d3f367baa10



--------------------------------

Commit c9a40292a44e78f71258b8522655bffaf5753bdb upstream.

io_eventfd_do_signal() is invoked from an RCU callback, but when
dropping the reference to the io_ev_fd, it calls io_eventfd_free()
directly if the refcount drops to zero. This isn't correct, as any
potential freeing of the io_ev_fd should be deferred another RCU grace
period.

Just call io_eventfd_put() rather than open-code the dec-and-test and
free, which will correctly defer it another RCU grace period.

Fixes: 21a091b9 ("io_uring: signal registered eventfd to process deferred task work")
Reported-by: default avatarJann Horn <jannh@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarWen Zhiwei <wenzhiwei@kylinos.cn>
parent e8c7264d

io_uring/io_uring.c

+9 −4
Original line number Diff line number Diff line
@@ -537,6 +537,13 @@ static __cold void io_queue_deferred(struct io_ring_ctx *ctx) 
	}

}



static void io_eventfd_free(struct rcu_head *rcu)

{

	struct io_ev_fd *ev_fd = container_of(rcu, struct io_ev_fd, rcu);



	eventfd_ctx_put(ev_fd->cq_ev_fd);

	kfree(ev_fd);

}



static void io_eventfd_ops(struct rcu_head *rcu)

{
@@ -550,10 +557,8 @@ static void io_eventfd_ops(struct rcu_head *rcu) 
	 * ordering in a race but if references are 0 we know we have to free

	 * it regardless.

	 */

	if (atomic_dec_and_test(&ev_fd->refs)) {

		eventfd_ctx_put(ev_fd->cq_ev_fd);

		kfree(ev_fd);

	}

	if (atomic_dec_and_test(&ev_fd->refs))

		call_rcu(&ev_fd->rcu, io_eventfd_free);

}



static void io_eventfd_signal(struct io_ring_ctx *ctx)