diff options
| author | Pavel Begunkov <asml.silence@gmail.com> | 2021-05-20 13:21:20 +0100 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2021-05-20 07:29:11 -0600 |
| commit | ba5ef6dc8a827a904794210a227cdb94828e8ae7 (patch) | |
| tree | 1c985bd07f6c61cfe7be947fe2325dd6f880a40a | |
| parent | 7a274727702cc07d27cdebd36d1d5132abeea12f (diff) | |
io_uring: fortify tctx/io_wq cleanupio_uring-5.13-2021-05-22
We don't want anyone poking into tctx->io_wq awhile it's being destroyed
by io_wq_put_and_exit(), and even though it shouldn't even happen, if
buggy would be preferable to get a NULL-deref instead of subtle delayed
failure or UAF.
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/827b021de17926fd807610b3e53a5a5fa8530856.1621513214.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
| -rw-r--r-- | fs/io_uring.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/fs/io_uring.c b/fs/io_uring.c index 89ec10471b30..5f82954004f6 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -9035,15 +9035,15 @@ static void io_uring_del_task_file(unsigned long index) static void io_uring_clean_tctx(struct io_uring_task *tctx) { + struct io_wq *wq = tctx->io_wq; struct io_tctx_node *node; unsigned long index; + tctx->io_wq = NULL; xa_for_each(&tctx->xa, index, node) io_uring_del_task_file(index); - if (tctx->io_wq) { - io_wq_put_and_exit(tctx->io_wq); - tctx->io_wq = NULL; - } + if (wq) + io_wq_put_and_exit(wq); } static s64 tctx_inflight(struct io_uring_task *tctx, bool tracked) |