Commit ba5ef6dc authored by Pavel Begunkov's avatar Pavel Begunkov Committed by Jens Axboe
Browse files

io_uring: fortify tctx/io_wq cleanup 



We don't want anyone poking into tctx->io_wq awhile it's being destroyed
by io_wq_put_and_exit(), and even though it shouldn't even happen, if
buggy would be preferable to get a NULL-deref instead of subtle delayed
failure or UAF.

Signed-off-by: default avatarPavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/827b021de17926fd807610b3e53a5a5fa8530856.1621513214.git.asml.silence@gmail.com


Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 7a274727

fs/io_uring.c

+4 −4
Original line number Diff line number Diff line
@@ -9035,15 +9035,15 @@ static void io_uring_del_task_file(unsigned long index) 


static void io_uring_clean_tctx(struct io_uring_task *tctx)

{

	struct io_wq *wq = tctx->io_wq;

	struct io_tctx_node *node;

	unsigned long index;



	tctx->io_wq = NULL;

	xa_for_each(&tctx->xa, index, node)

		io_uring_del_task_file(index);

	if (tctx->io_wq) {

		io_wq_put_and_exit(tctx->io_wq);

		tctx->io_wq = NULL;

	}

	if (wq)

		io_wq_put_and_exit(wq);

}



static s64 tctx_inflight(struct io_uring_task *tctx, bool tracked)