diff options
| author | Matthew Wilcox (Oracle) <willy@infradead.org> | 2020-10-09 15:49:52 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-11-01 14:45:36 +0300 |
| commit | f7b24bee5e6ef939d8c312483cd4ea2648df81d0 (patch) | |
| tree | 38d8e73ee2e1e54e973eb19f3ddc72cc35dbde71 | |
| parent | efce965a49f118521da9a0e60e7c3a91bdce4cd9 (diff) | |
| download | linux-f7b24bee5e6ef939d8c312483cd4ea2648df81d0.tar.xz | |
io_uring: Fix XArray usage in io_uring_add_task_file
commit 236434c3438c4da3dfbd6aeeab807577b85e951a upstream.
The xas_store() wasn't paired with an xas_nomem() loop, so if it couldn't
allocate memory using GFP_NOWAIT, it would leak the reference to the file
descriptor. Also the node pointed to by the xas could be freed between
the call to xas_load() under the rcu_read_lock() and the acquisition of
the xa_lock.
It's easier to just use the normal xa_load/xa_store interface here.
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
[axboe: fix missing assign after alloc, cur_uring -> tctx rename]
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | fs/io_uring.c | 21 |
1 files changed, 9 insertions, 12 deletions
diff --git a/fs/io_uring.c b/fs/io_uring.c index dfffa6a07a92..f8053e85f5b0 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -7929,27 +7929,24 @@ static void io_uring_cancel_task_requests(struct io_ring_ctx *ctx, */ static int io_uring_add_task_file(struct file *file) { - if (unlikely(!current->io_uring)) { + struct io_uring_task *tctx = current->io_uring; + + if (unlikely(!tctx)) { int ret; ret = io_uring_alloc_task_context(current); if (unlikely(ret)) return ret; + tctx = current->io_uring; } - if (current->io_uring->last != file) { - XA_STATE(xas, ¤t->io_uring->xa, (unsigned long) file); - void *old; + if (tctx->last != file) { + void *old = xa_load(&tctx->xa, (unsigned long)file); - rcu_read_lock(); - old = xas_load(&xas); - if (old != file) { + if (!old) { get_file(file); - xas_lock(&xas); - xas_store(&xas, file); - xas_unlock(&xas); + xa_store(&tctx->xa, (unsigned long)file, file, GFP_KERNEL); } - rcu_read_unlock(); - current->io_uring->last = file; + tctx->last = file; } return 0; |