lkml.org 
[lkml]   [2020]   [Nov]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.9 061/255] io_uring: ensure consistent view of original task ->mm from SQPOLL
    Date
    From: Jens Axboe <axboe@kernel.dk>

    [ Upstream commit 4b70cf9dea4cd239b425f3282fa56ce19e234c8a ]

    Ensure we get a valid view of the task mm, by using task_lock() when
    attempting to grab the original task mm.

    Reported-by: syzbot+b57abf7ee60829090495@syzkaller.appspotmail.com
    Fixes: 2aede0e417db ("io_uring: stash ctx task reference for SQPOLL")
    Signed-off-by: Jens Axboe <axboe@kernel.dk>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    fs/io_uring.c | 27 ++++++++++++++++++++-------
    1 file changed, 20 insertions(+), 7 deletions(-)

    diff --git a/fs/io_uring.c b/fs/io_uring.c
    index 1033e0e18f24f..2d5ca9476814d 100644
    --- a/fs/io_uring.c
    +++ b/fs/io_uring.c
    @@ -952,20 +952,33 @@ static void io_sq_thread_drop_mm(void)
    if (mm) {
    kthread_unuse_mm(mm);
    mmput(mm);
    + current->mm = NULL;
    }
    }

    static int __io_sq_thread_acquire_mm(struct io_ring_ctx *ctx)
    {
    - if (!current->mm) {
    - if (unlikely(!(ctx->flags & IORING_SETUP_SQPOLL) ||
    - !ctx->sqo_task->mm ||
    - !mmget_not_zero(ctx->sqo_task->mm)))
    - return -EFAULT;
    - kthread_use_mm(ctx->sqo_task->mm);
    + struct mm_struct *mm;
    +
    + if (current->mm)
    + return 0;
    +
    + /* Should never happen */
    + if (unlikely(!(ctx->flags & IORING_SETUP_SQPOLL)))
    + return -EFAULT;
    +
    + task_lock(ctx->sqo_task);
    + mm = ctx->sqo_task->mm;
    + if (unlikely(!mm || !mmget_not_zero(mm)))
    + mm = NULL;
    + task_unlock(ctx->sqo_task);
    +
    + if (mm) {
    + kthread_use_mm(mm);
    + return 0;
    }

    - return 0;
    + return -EFAULT;
    }

    static int io_sq_thread_acquire_mm(struct io_ring_ctx *ctx,
    --
    2.27.0


    \
     
     \ /
      Last update: 2020-11-17 14:39    [W:4.051 / U:0.104 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site