* [PATCH 5.13] io_uring: fortify tctx/io_wq cleanup
@ 2021-05-20 12:21 Pavel Begunkov
2021-05-20 13:55 ` Jens Axboe
0 siblings, 1 reply; 2+ messages in thread
From: Pavel Begunkov @ 2021-05-20 12:21 UTC (permalink / raw)
To: Jens Axboe, io-uring
We don't want anyone poking into tctx->io_wq awhile it's being destroyed
by io_wq_put_and_exit(), and even though it shouldn't even happen, if
buggy would be preferable to get a NULL-deref instead of subtle delayed
failure or UAF.
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
---
fs/io_uring.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/fs/io_uring.c b/fs/io_uring.c
index 89ec10471b30..5f82954004f6 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -9035,15 +9035,15 @@ static void io_uring_del_task_file(unsigned long index)
static void io_uring_clean_tctx(struct io_uring_task *tctx)
{
+ struct io_wq *wq = tctx->io_wq;
struct io_tctx_node *node;
unsigned long index;
+ tctx->io_wq = NULL;
xa_for_each(&tctx->xa, index, node)
io_uring_del_task_file(index);
- if (tctx->io_wq) {
- io_wq_put_and_exit(tctx->io_wq);
- tctx->io_wq = NULL;
- }
+ if (wq)
+ io_wq_put_and_exit(wq);
}
static s64 tctx_inflight(struct io_uring_task *tctx, bool tracked)
--
2.31.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH 5.13] io_uring: fortify tctx/io_wq cleanup
2021-05-20 12:21 [PATCH 5.13] io_uring: fortify tctx/io_wq cleanup Pavel Begunkov
@ 2021-05-20 13:55 ` Jens Axboe
0 siblings, 0 replies; 2+ messages in thread
From: Jens Axboe @ 2021-05-20 13:55 UTC (permalink / raw)
To: Pavel Begunkov, io-uring
On 5/20/21 6:21 AM, Pavel Begunkov wrote:
> We don't want anyone poking into tctx->io_wq awhile it's being destroyed
> by io_wq_put_and_exit(), and even though it shouldn't even happen, if
> buggy would be preferable to get a NULL-deref instead of subtle delayed
> failure or UAF.
Applied, thanks.
--
Jens Axboe
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-05-20 13:55 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-05-20 12:21 [PATCH 5.13] io_uring: fortify tctx/io_wq cleanup Pavel Begunkov
2021-05-20 13:55 ` Jens Axboe
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.