path: root/fs
diff options
authorPavel Begunkov <asml.silence@gmail.com>2021-05-20 13:21:20 +0100
committerJens Axboe <axboe@kernel.dk>2021-05-20 07:29:11 -0600
commitba5ef6dc8a827a904794210a227cdb94828e8ae7 (patch)
tree1c985bd07f6c61cfe7be947fe2325dd6f880a40a /fs
parent7a274727702cc07d27cdebd36d1d5132abeea12f (diff)
io_uring: fortify tctx/io_wq cleanup
We don't want anyone poking into tctx->io_wq awhile it's being destroyed by io_wq_put_and_exit(), and even though it shouldn't even happen, if buggy would be preferable to get a NULL-deref instead of subtle delayed failure or UAF. Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Link: https://lore.kernel.org/r/827b021de17926fd807610b3e53a5a5fa8530856.1621513214.git.asml.silence@gmail.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'fs')
1 files changed, 4 insertions, 4 deletions
diff --git a/fs/io_uring.c b/fs/io_uring.c
index 89ec10471b30..5f82954004f6 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -9035,15 +9035,15 @@ static void io_uring_del_task_file(unsigned long index)
static void io_uring_clean_tctx(struct io_uring_task *tctx)
+ struct io_wq *wq = tctx->io_wq;
struct io_tctx_node *node;
unsigned long index;
+ tctx->io_wq = NULL;
xa_for_each(&tctx->xa, index, node)
- if (tctx->io_wq) {
- io_wq_put_and_exit(tctx->io_wq);
- tctx->io_wq = NULL;
- }
+ if (wq)
+ io_wq_put_and_exit(wq);
static s64 tctx_inflight(struct io_uring_task *tctx, bool tracked)

Privacy Policy