6.6-stable patches

added patches:
	io_uring-check-for-non-null-file-pointer-in-io_file_can_poll.patch
	io_uring-rsrc-don-t-lock-while-task_running.patch

diff --git a/queue-6.6/io_uring-check-for-non-null-file-pointer-in-io_file_can_poll.patch b/queue-6.6/io_uring-check-for-non-null-file-pointer-in-io_file_can_poll.patch
new file mode 100644 (file)
index 0000000..36be57e
--- /dev/null
+++ b/queue-6.6/io_uring-check-for-non-null-file-pointer-in-io_file_can_poll.patch
@@ -0,0 +1,77 @@
+From fb95c76195692d1593cb29a7a353389d5dcf43b8 Mon Sep 17 00:00:00 2001
+From: Jens Axboe <axboe@kernel.dk>
+Date: Sat, 1 Jun 2024 12:25:35 -0600
+Subject: io_uring: check for non-NULL file pointer in io_file_can_poll()
+
+From: Jens Axboe <axboe@kernel.dk>
+
+commit 5fc16fa5f13b3c06fdb959ef262050bd810416a2 upstream.
+
+In earlier kernels, it was possible to trigger a NULL pointer
+dereference off the forced async preparation path, if no file had
+been assigned. The trace leading to that looks as follows:
+
+BUG: kernel NULL pointer dereference, address: 00000000000000b0
+PGD 0 P4D 0
+Oops: 0000 [#1] PREEMPT SMP
+CPU: 67 PID: 1633 Comm: buf-ring-invali Not tainted 6.8.0-rc3+ #1
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS unknown 2/2/2022
+RIP: 0010:io_buffer_select+0xc3/0x210
+Code: 00 00 48 39 d1 0f 82 ae 00 00 00 48 81 4b 48 00 00 01 00 48 89 73 70 0f b7 50 0c 66 89 53 42 85 ed 0f 85 d2 00 00 00 48 8b 13 <48> 8b 92 b0 00 00 00 48 83 7a 40 00 0f 84 21 01 00 00 4c 8b 20 5b
+RSP: 0018:ffffb7bec38c7d88 EFLAGS: 00010246
+RAX: ffff97af2be61000 RBX: ffff97af234f1700 RCX: 0000000000000040
+RDX: 0000000000000000 RSI: ffff97aecfb04820 RDI: ffff97af234f1700
+RBP: 0000000000000000 R08: 0000000000200030 R09: 0000000000000020
+R10: ffffb7bec38c7dc8 R11: 000000000000c000 R12: ffffb7bec38c7db8
+R13: ffff97aecfb05800 R14: ffff97aecfb05800 R15: ffff97af2be5e000
+FS:  00007f852f74b740(0000) GS:ffff97b1eeec0000(0000) knlGS:0000000000000000
+CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 00000000000000b0 CR3: 000000016deab005 CR4: 0000000000370ef0
+Call Trace:
+ <TASK>
+ ? __die+0x1f/0x60
+ ? page_fault_oops+0x14d/0x420
+ ? do_user_addr_fault+0x61/0x6a0
+ ? exc_page_fault+0x6c/0x150
+ ? asm_exc_page_fault+0x22/0x30
+ ? io_buffer_select+0xc3/0x210
+ __io_import_iovec+0xb5/0x120
+ io_readv_prep_async+0x36/0x70
+ io_queue_sqe_fallback+0x20/0x260
+ io_submit_sqes+0x314/0x630
+ __do_sys_io_uring_enter+0x339/0xbc0
+ ? __do_sys_io_uring_register+0x11b/0xc50
+ ? vm_mmap_pgoff+0xce/0x160
+ do_syscall_64+0x5f/0x180
+ entry_SYSCALL_64_after_hwframe+0x46/0x4e
+RIP: 0033:0x55e0a110a67e
+Code: ba cc 00 00 00 45 31 c0 44 0f b6 92 d0 00 00 00 31 d2 41 b9 08 00 00 00 41 83 e2 01 41 c1 e2 04 41 09 c2 b8 aa 01 00 00 0f 05 <c3> 90 89 30 eb a9 0f 1f 40 00 48 8b 42 20 8b 00 a8 06 75 af 85 f6
+
+because the request is marked forced ASYNC and has a bad file fd, and
+hence takes the forced async prep path.
+
+Current kernels with the request async prep cleaned up can no longer hit
+this issue, but for ease of backporting, let's add this safety check in
+here too as it really doesn't hurt. For both cases, this will inevitably
+end with a CQE posted with -EBADF.
+
+Cc: stable@vger.kernel.org
+Fixes: a76c0b31eef5 ("io_uring: commit non-pollable provided mapped buffers upfront")
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ io_uring/kbuf.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/io_uring/kbuf.c
++++ b/io_uring/kbuf.c
+@@ -168,7 +168,8 @@ static void __user *io_ring_buffer_selec
+       req->buf_list = bl;
+       req->buf_index = buf->bid;
+ 
+-      if (issue_flags & IO_URING_F_UNLOCKED || !file_can_poll(req->file)) {
++      if (issue_flags & IO_URING_F_UNLOCKED ||
++          (req->file && !file_can_poll(req->file))) {
+               /*
+                * If we came in unlocked, we have no choice but to consume the
+                * buffer here, otherwise nothing ensures that the buffer won't

diff --git a/queue-6.6/io_uring-rsrc-don-t-lock-while-task_running.patch b/queue-6.6/io_uring-rsrc-don-t-lock-while-task_running.patch
new file mode 100644 (file)
index 0000000..6412ad8
--- /dev/null
+++ b/queue-6.6/io_uring-rsrc-don-t-lock-while-task_running.patch
@@ -0,0 +1,52 @@
+From 54559642b96116b45e4b5ca7fd9f7835b8561272 Mon Sep 17 00:00:00 2001
+From: Pavel Begunkov <asml.silence@gmail.com>
+Date: Wed, 12 Jun 2024 13:56:38 +0100
+Subject: io_uring/rsrc: don't lock while !TASK_RUNNING
+
+From: Pavel Begunkov <asml.silence@gmail.com>
+
+commit 54559642b96116b45e4b5ca7fd9f7835b8561272 upstream.
+
+There is a report of io_rsrc_ref_quiesce() locking a mutex while not
+TASK_RUNNING, which is due to forgetting restoring the state back after
+io_run_task_work_sig() and attempts to break out of the waiting loop.
+
+do not call blocking ops when !TASK_RUNNING; state=1 set at
+[<ffffffff815d2494>] prepare_to_wait+0xa4/0x380
+kernel/sched/wait.c:237
+WARNING: CPU: 2 PID: 397056 at kernel/sched/core.c:10099
+__might_sleep+0x114/0x160 kernel/sched/core.c:10099
+RIP: 0010:__might_sleep+0x114/0x160 kernel/sched/core.c:10099
+Call Trace:
+ <TASK>
+ __mutex_lock_common kernel/locking/mutex.c:585 [inline]
+ __mutex_lock+0xb4/0x940 kernel/locking/mutex.c:752
+ io_rsrc_ref_quiesce+0x590/0x940 io_uring/rsrc.c:253
+ io_sqe_buffers_unregister+0xa2/0x340 io_uring/rsrc.c:799
+ __io_uring_register io_uring/register.c:424 [inline]
+ __do_sys_io_uring_register+0x5b9/0x2400 io_uring/register.c:613
+ do_syscall_x64 arch/x86/entry/common.c:52 [inline]
+ do_syscall_64+0xd8/0x270 arch/x86/entry/common.c:83
+ entry_SYSCALL_64_after_hwframe+0x6f/0x77
+
+Reported-by: Li Shi <sl1589472800@gmail.com>
+Fixes: 4ea15b56f0810 ("io_uring/rsrc: use wq for quiescing")
+Cc: stable@vger.kernel.org
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Link: https://lore.kernel.org/r/77966bc104e25b0534995d5dbb152332bc8f31c0.1718196953.git.asml.silence@gmail.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ io_uring/rsrc.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/io_uring/rsrc.c
++++ b/io_uring/rsrc.c
+@@ -250,6 +250,7 @@ __cold static int io_rsrc_ref_quiesce(st
+ 
+               ret = io_run_task_work_sig(ctx);
+               if (ret < 0) {
++                      __set_current_state(TASK_RUNNING);
+                       mutex_lock(&ctx->uring_lock);
+                       if (list_empty(&ctx->rsrc_ref_list))
+                               ret = 0;

diff --git a/queue-6.6/series b/queue-6.6/series
index 3654832b81706f151bf6926bd395c54fe7a54bac..367ae19efb7373689d211698d8404e8b1627752c 100644 (file)
--- a/queue-6.6/series
+++ b/queue-6.6/series
@@ -78,3 +78,5 @@ eventfs-update-all-the-eventfs_inodes-from-the-event.patch
 bpf-fix-multi-uprobe-pid-filtering-logic.patch
 nilfs2-return-the-mapped-address-from-nilfs_get_page.patch
 nilfs2-fix-nilfs_empty_dir-misjudgment-and-long-loop.patch
+io_uring-rsrc-don-t-lock-while-task_running.patch
+io_uring-check-for-non-null-file-pointer-in-io_file_can_poll.patch