Fixes for 6.5

Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/queue-6.5/io_uring-fdinfo-lock-sq-thread-while-retrieving-thre.patch b/queue-6.5/io_uring-fdinfo-lock-sq-thread-while-retrieving-thre.patch
new file mode 100644 (file)
index 0000000..ca6c103
--- /dev/null
+++ b/queue-6.5/io_uring-fdinfo-lock-sq-thread-while-retrieving-thre.patch
@@ -0,0 +1,71 @@
+From b89f17c793fa19b3fa35945a8671b2eda241b57a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 28 Oct 2023 07:30:27 -0600
+Subject: io_uring/fdinfo: lock SQ thread while retrieving thread cpu/pid
+
+From: Jens Axboe <axboe@kernel.dk>
+
+commit 7644b1a1c9a7ae8ab99175989bfc8676055edb46 upstream.
+
+We could race with SQ thread exit, and if we do, we'll hit a NULL pointer
+dereference when the thread is cleared. Grab the SQPOLL data lock before
+attempting to get the task cpu and pid for fdinfo, this ensures we have a
+stable view of it.
+
+Cc: stable@vger.kernel.org
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=218032
+Reviewed-by: Gabriel Krisman Bertazi <krisman@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ io_uring/fdinfo.c | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/io_uring/fdinfo.c b/io_uring/fdinfo.c
+index 76c279b13aee4..b603a06f7103d 100644
+--- a/io_uring/fdinfo.c
++++ b/io_uring/fdinfo.c
+@@ -49,7 +49,6 @@ static __cold int io_uring_show_cred(struct seq_file *m, unsigned int id,
+ static __cold void __io_uring_show_fdinfo(struct io_ring_ctx *ctx,
+                                         struct seq_file *m)
+ {
+-      struct io_sq_data *sq = NULL;
+       struct io_overflow_cqe *ocqe;
+       struct io_rings *r = ctx->rings;
+       unsigned int sq_mask = ctx->sq_entries - 1, cq_mask = ctx->cq_entries - 1;
+@@ -60,6 +59,7 @@ static __cold void __io_uring_show_fdinfo(struct io_ring_ctx *ctx,
+       unsigned int cq_shift = 0;
+       unsigned int sq_shift = 0;
+       unsigned int sq_entries, cq_entries;
++      int sq_pid = -1, sq_cpu = -1;
+       bool has_lock;
+       unsigned int i;
+ 
+@@ -137,13 +137,19 @@ static __cold void __io_uring_show_fdinfo(struct io_ring_ctx *ctx,
+       has_lock = mutex_trylock(&ctx->uring_lock);
+ 
+       if (has_lock && (ctx->flags & IORING_SETUP_SQPOLL)) {
+-              sq = ctx->sq_data;
+-              if (!sq->thread)
+-                      sq = NULL;
++              struct io_sq_data *sq = ctx->sq_data;
++
++              if (mutex_trylock(&sq->lock)) {
++                      if (sq->thread) {
++                              sq_pid = task_pid_nr(sq->thread);
++                              sq_cpu = task_cpu(sq->thread);
++                      }
++                      mutex_unlock(&sq->lock);
++              }
+       }
+ 
+-      seq_printf(m, "SqThread:\t%d\n", sq ? task_pid_nr(sq->thread) : -1);
+-      seq_printf(m, "SqThreadCpu:\t%d\n", sq ? task_cpu(sq->thread) : -1);
++      seq_printf(m, "SqThread:\t%d\n", sq_pid);
++      seq_printf(m, "SqThreadCpu:\t%d\n", sq_cpu);
+       seq_printf(m, "UserFiles:\t%u\n", ctx->nr_user_files);
+       for (i = 0; has_lock && i < ctx->nr_user_files; i++) {
+               struct file *f = io_file_from_index(&ctx->file_table, i);
+-- 
+2.42.0
+

diff --git a/queue-6.5/series b/queue-6.5/series
index 63882e12c0f929a70b5c15287fe413c223b456f8..e358a847bce2d8f1f10a650d7d50974e1f4b54e1 100644 (file)
--- a/queue-6.5/series
+++ b/queue-6.5/series
@@ -82,3 +82,4 @@ iavf-in-iavf_down-disable-queues-when-removing-the-d.patch
 scsi-sd-introduce-manage_shutdown-device-flag.patch
 blk-throttle-check-for-overflow-in-calculate_bytes_allowed.patch
 kasan-print-the-original-fault-addr-when-access-invalid-shadow.patch
+io_uring-fdinfo-lock-sq-thread-while-retrieving-thre.patch