[SRU Jammy 08/12] io_uring: remove poll entry from list when canceling all
Thadeu Lima de Souza Cascardo
cascardo at canonical.com
Mon Sep 19 17:58:06 UTC 2022
From: Jens Axboe <axboe at kernel.dk>
[ upstream commmit 61bc84c4008812d784c398cfb54118c1ba396dfc ]
When the ring is exiting, as part of the shutdown, poll requests are
removed. But io_poll_remove_all() does not remove entries when finding
them, and since completions are done out-of-band, we can find and remove
the same entry multiple times.
We do guard the poll execution by poll ownership, but that does not
exclude us from reissuing a new one once the previous removal ownership
goes away.
This can race with poll execution as well, where we then end up seeing
req->apoll be NULL because a previous task_work requeue finished the
request.
Remove the poll entry when we find it and get ownership of it. This
prevents multiple invocations from finding it.
Fixes: aa43477b0402 ("io_uring: poll rework")
Reported-by: Dylan Yudaken <dylany at fb.com>
Signed-off-by: Jens Axboe <axboe at kernel.dk>
[pavel: backport]
Signed-off-by: Pavel Begunkov <asml.silence at gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
(cherry picked from commit 7524ec52caa893a3aeae85488f19dc2f71c8e7b9 linux-5.15.y)
CVE-2022-3176
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo at canonical.com>
---
fs/io_uring.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/fs/io_uring.c b/fs/io_uring.c
index bc4741061258..dd750d6f00fd 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -5720,6 +5720,7 @@ static bool io_poll_remove_all(struct io_ring_ctx *ctx, struct task_struct *tsk,
list = &ctx->cancel_hash[i];
hlist_for_each_entry_safe(req, tmp, list, hash_node) {
if (io_match_task_safe(req, tsk, cancel_all)) {
+ hlist_del_init(&req->hash_node);
io_poll_cancel_req(req);
found = true;
}
--
2.34.1
More information about the kernel-team
mailing list