From: Jens Axboe Date: Mon, 22 Apr 2019 16:23:23 +0000 (-0600) Subject: io_uring: fail io_uring_register(2) on a dying io_uring instance X-Git-Tag: v5.1-rc7~3^2~4 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=35fa71a030caa50458a043560d4814ea9bcd639f;p=thirdparty%2Flinux.git io_uring: fail io_uring_register(2) on a dying io_uring instance If we have multiple threads doing io_uring_register(2) on an io_uring fd, then we can potentially try and kill the percpu reference while someone else has already killed it. Prevent this race by failing io_uring_register(2) if the ref is marked dying. This is safe since we're inside the io_uring mutex. Fixes: b19062a56726 ("io_uring: fix possible deadlock between io_uring_{enter,register}") Reported-by: syzbot Signed-off-by: Jens Axboe --- diff --git a/fs/io_uring.c b/fs/io_uring.c index f65f85d892174..a2f39faed6a7e 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -2934,6 +2934,14 @@ static int __io_uring_register(struct io_ring_ctx *ctx, unsigned opcode, { int ret; + /* + * We're inside the ring mutex, if the ref is already dying, then + * someone else killed the ctx or is already going through + * io_uring_register(). + */ + if (percpu_ref_is_dying(&ctx->refs)) + return -ENXIO; + percpu_ref_kill(&ctx->refs); /*