Commit e7637a49 authored by Jens Axboe's avatar Jens Axboe
Browse files

io_uring: fix locking state for empty buffer group 



io_provided_buffer_select() must drop the submit lock, if needed, even
in the error handling case. Failure to do so will leave us with the
ctx->uring_lock held, causing spew like:

====================================
WARNING: iou-wrk-366/368 still has locks held!
5.18.0-rc6-00294-gdf8dc7004331 #994 Not tainted
------------------------------------
1 lock held by iou-wrk-366/368:
 #0: ffff0000c72598a8 (&ctx->uring_lock){+.+.}-{3:3}, at: io_ring_submit_lock+0x20/0x48

stack backtrace:
CPU: 4 PID: 368 Comm: iou-wrk-366 Not tainted 5.18.0-rc6-00294-gdf8dc7004331 #994
Hardware name: linux,dummy-virt (DT)
Call trace:
 dump_backtrace.part.0+0xa4/0xd4
 show_stack+0x14/0x5c
 dump_stack_lvl+0x88/0xb0
 dump_stack+0x14/0x2c
 debug_check_no_locks_held+0x84/0x90
 try_to_freeze.isra.0+0x18/0x44
 get_signal+0x94/0x6ec
 io_wqe_worker+0x1d8/0x2b4
 ret_from_fork+0x10/0x20

and triggering later hangs off get_signal() because we attempt to
re-grab the lock.

Reported-by: default avatar <syzbot+987d7bb19195ae45208c@syzkaller.appspotmail.com>
Fixes: 149c69b0 ("io_uring: abstract out provided buffer list selection")
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 4e86a2c9

fs/io_uring.c

+14 −11
Original line number Diff line number Diff line
@@ -3467,10 +3467,10 @@ static void __user *io_provided_buffer_select(struct io_kiocb *req, size_t *len, 
					      struct io_buffer_list *bl,

					      unsigned int issue_flags)

{

	struct io_buffer *kbuf;

	void __user *ret = ERR_PTR(-ENOBUFS);



	if (list_empty(&bl->buf_list))

		return ERR_PTR(-ENOBUFS);

	if (!list_empty(&bl->buf_list)) {

		struct io_buffer *kbuf;



		kbuf = list_first_entry(&bl->buf_list, struct io_buffer, list);

		list_del(&kbuf->list);
@@ -3479,8 +3479,11 @@ static void __user *io_provided_buffer_select(struct io_kiocb *req, size_t *len, 
		req->flags |= REQ_F_BUFFER_SELECTED;

		req->kbuf = kbuf;

		req->buf_index = kbuf->bid;

		ret = u64_to_user_ptr(kbuf->addr);

	}



	io_ring_submit_unlock(req->ctx, issue_flags);

	return u64_to_user_ptr(kbuf->addr);

	return ret;

}



static void __user *io_buffer_select(struct io_kiocb *req, size_t *len,