diff options
| author |   Jens Axboe <axboe@kernel.dk> | 2020-11-02 10:39:05 -0700 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2020-11-04 10:22:57 -0700 |
| commit | 4b70cf9dea4cd239b425f3282fa56ce19e234c8a (patch) | |
| tree | 9526725d90a8add9b5d5547a81100d01b2f1cb61 /fs/io_uring.c | |
| parent | io_uring: properly handle SQPOLL request cancelations (diff) | |
| download | linux-dev-4b70cf9dea4cd239b425f3282fa56ce19e234c8a.tar.xz linux-dev-4b70cf9dea4cd239b425f3282fa56ce19e234c8a.zip | |
io_uring: ensure consistent view of original task ->mm from SQPOLL
Ensure we get a valid view of the task mm, by using task_lock() when
attempting to grab the original task mm.
Reported-by: syzbot+b57abf7ee60829090495@syzkaller.appspotmail.com
Fixes: 2aede0e417db ("io_uring: stash ctx task reference for SQPOLL")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'fs/io_uring.c')
| -rw-r--r-- | fs/io_uring.c | 27 |
1 files changed, 20 insertions, 7 deletions
diff --git a/fs/io_uring.c b/fs/io_uring.c index b398394a919e..fd61708dba2b 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -995,20 +995,33 @@ static void io_sq_thread_drop_mm(void) if (mm) { kthread_unuse_mm(mm); mmput(mm); + current->mm = NULL; } } static int __io_sq_thread_acquire_mm(struct io_ring_ctx *ctx) { - if (!current->mm) { - if (unlikely(!(ctx->flags & IORING_SETUP_SQPOLL) || - !ctx->sqo_task->mm || - !mmget_not_zero(ctx->sqo_task->mm))) - return -EFAULT; - kthread_use_mm(ctx->sqo_task->mm); + struct mm_struct *mm; + + if (current->mm) + return 0; + + /* Should never happen */ + if (unlikely(!(ctx->flags & IORING_SETUP_SQPOLL))) + return -EFAULT; + + task_lock(ctx->sqo_task); + mm = ctx->sqo_task->mm; + if (unlikely(!mm || !mmget_not_zero(mm))) + mm = NULL; + task_unlock(ctx->sqo_task); + + if (mm) { + kthread_use_mm(mm); + return 0; } - return 0; + return -EFAULT; } static int io_sq_thread_acquire_mm(struct io_ring_ctx *ctx, |