diff options
| author | Pavel Begunkov <asml.silence@gmail.com> | 2021-04-13 04:58:38 +0300 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2021-04-13 18:37:54 +0300 |
| commit | 084804002e512427bfe52b448cb7cac0d4209b64 (patch) | |
| tree | 7b60c51c386a1d7a96f1ab693f615fa982a0d8c5 /fs/io_uring.c | |
| parent | f70865db5ff35f5ed0c7e9ef63e7cca3d4947f04 (diff) | |
| download | linux-084804002e512427bfe52b448cb7cac0d4209b64.tar.xz | |
io_uring: fix leaking reg files on exit
If io_sqe_files_unregister() faults on io_rsrc_ref_quiesce(), it will
fail to do unregister leaving files referenced. And that may well happen
because of a strayed signal or just because it does allocations inside.
In io_ring_ctx_free() do an unsafe version of unregister, as it's
guaranteed to not have requests by that point and so quiesce is useless.
Cc: stable@vger.kernel.org
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/e696e9eade571b51997d0dc1d01f144c6d685c05.1618278933.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'fs/io_uring.c')
| -rw-r--r-- | fs/io_uring.c | 29 |
1 files changed, 15 insertions, 14 deletions
diff --git a/fs/io_uring.c b/fs/io_uring.c index 8564c7908126..1af8bb5f7d56 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -7089,6 +7089,10 @@ static void __io_sqe_files_unregister(struct io_ring_ctx *ctx) fput(file); } #endif + io_free_file_tables(&ctx->file_table, ctx->nr_user_files); + kfree(ctx->file_data); + ctx->file_data = NULL; + ctx->nr_user_files = 0; } static inline void io_rsrc_ref_lock(struct io_ring_ctx *ctx) @@ -7195,21 +7199,14 @@ static struct io_rsrc_data *io_rsrc_data_alloc(struct io_ring_ctx *ctx, static int io_sqe_files_unregister(struct io_ring_ctx *ctx) { - struct io_rsrc_data *data = ctx->file_data; int ret; - if (!data) + if (!ctx->file_data) return -ENXIO; - ret = io_rsrc_ref_quiesce(data, ctx); - if (ret) - return ret; - - __io_sqe_files_unregister(ctx); - io_free_file_tables(&ctx->file_table, ctx->nr_user_files); - kfree(data); - ctx->file_data = NULL; - ctx->nr_user_files = 0; - return 0; + ret = io_rsrc_ref_quiesce(ctx->file_data, ctx); + if (!ret) + __io_sqe_files_unregister(ctx); + return ret; } static void io_sq_thread_unpark(struct io_sq_data *sqd) @@ -7659,7 +7656,7 @@ static int io_sqe_files_register(struct io_ring_ctx *ctx, void __user *arg, ret = io_sqe_files_scm(ctx); if (ret) { - io_sqe_files_unregister(ctx); + __io_sqe_files_unregister(ctx); return ret; } @@ -8460,7 +8457,11 @@ static void io_ring_ctx_free(struct io_ring_ctx *ctx) } mutex_lock(&ctx->uring_lock); - io_sqe_files_unregister(ctx); + if (ctx->file_data) { + if (!atomic_dec_and_test(&ctx->file_data->refs)) + wait_for_completion(&ctx->file_data->done); + __io_sqe_files_unregister(ctx); + } if (ctx->rings) __io_cqring_overflow_flush(ctx, true); mutex_unlock(&ctx->uring_lock); |