From 96ee2d440e588453652abf32c339b655b42d977d Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 11 Dec 2023 14:23:30 +0100 Subject: [PATCH] 5.15-stable patches added patches: io_uring-af_unix-disable-sending-io_uring-over-sockets.patch --- ...isable-sending-io_uring-over-sockets.patch | 128 ++++++++++++++++++ queue-5.15/series | 1 + 2 files changed, 129 insertions(+) create mode 100644 queue-5.15/io_uring-af_unix-disable-sending-io_uring-over-sockets.patch diff --git a/queue-5.15/io_uring-af_unix-disable-sending-io_uring-over-sockets.patch b/queue-5.15/io_uring-af_unix-disable-sending-io_uring-over-sockets.patch new file mode 100644 index 00000000000..02697674ace --- /dev/null +++ b/queue-5.15/io_uring-af_unix-disable-sending-io_uring-over-sockets.patch @@ -0,0 +1,128 @@ +From 2ad25288b0f67d4a5120fe9fe6279ef6635bb986 Mon Sep 17 00:00:00 2001 +From: Pavel Begunkov +Date: Wed, 6 Dec 2023 13:26:47 +0000 +Subject: io_uring/af_unix: disable sending io_uring over sockets + +From: Pavel Begunkov + +commit 705318a99a138c29a512a72c3e0043b3cd7f55f4 upstream. + +File reference cycles have caused lots of problems for io_uring +in the past, and it still doesn't work exactly right and races with +unix_stream_read_generic(). The safest fix would be to completely +disallow sending io_uring files via sockets via SCM_RIGHT, so there +are no possible cycles invloving registered files and thus rendering +SCM accounting on the io_uring side unnecessary. + +Cc: +Fixes: 0091bfc81741b ("io_uring/af_unix: defer registered files gc to io_uring release") +Reported-and-suggested-by: Jann Horn +Signed-off-by: Pavel Begunkov +Link: https://lore.kernel.org/r/c716c88321939156909cfa1bd8b0faaf1c804103.1701868795.git.asml.silence@gmail.com +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + io_uring/io_uring.c | 55 ---------------------------------------------------- + net/core/scm.c | 6 +++++ + 2 files changed, 6 insertions(+), 55 deletions(-) + +--- a/io_uring/io_uring.c ++++ b/io_uring/io_uring.c +@@ -8627,49 +8627,6 @@ out_free: + return ret; + } + +-static int io_sqe_file_register(struct io_ring_ctx *ctx, struct file *file, +- int index) +-{ +-#if defined(CONFIG_UNIX) +- struct sock *sock = ctx->ring_sock->sk; +- struct sk_buff_head *head = &sock->sk_receive_queue; +- struct sk_buff *skb; +- +- /* +- * See if we can merge this file into an existing skb SCM_RIGHTS +- * file set. If there's no room, fall back to allocating a new skb +- * and filling it in. +- */ +- spin_lock_irq(&head->lock); +- skb = skb_peek(head); +- if (skb) { +- struct scm_fp_list *fpl = UNIXCB(skb).fp; +- +- if (fpl->count < SCM_MAX_FD) { +- __skb_unlink(skb, head); +- spin_unlock_irq(&head->lock); +- fpl->fp[fpl->count] = get_file(file); +- unix_inflight(fpl->user, fpl->fp[fpl->count]); +- fpl->count++; +- spin_lock_irq(&head->lock); +- __skb_queue_head(head, skb); +- } else { +- skb = NULL; +- } +- } +- spin_unlock_irq(&head->lock); +- +- if (skb) { +- fput(file); +- return 0; +- } +- +- return __io_sqe_files_scm(ctx, 1, index); +-#else +- return 0; +-#endif +-} +- + static int io_queue_rsrc_removal(struct io_rsrc_data *data, unsigned idx, + struct io_rsrc_node *node, void *rsrc) + { +@@ -8727,12 +8684,6 @@ static int io_install_fixed_file(struct + + *io_get_tag_slot(ctx->file_data, slot_index) = 0; + io_fixed_file_set(file_slot, file); +- ret = io_sqe_file_register(ctx, file, slot_index); +- if (ret) { +- file_slot->file_ptr = 0; +- goto err; +- } +- + ret = 0; + err: + if (needs_switch) +@@ -8846,12 +8797,6 @@ static int __io_sqe_files_update(struct + } + *io_get_tag_slot(data, i) = tag; + io_fixed_file_set(file_slot, file); +- err = io_sqe_file_register(ctx, file, i); +- if (err) { +- file_slot->file_ptr = 0; +- fput(file); +- break; +- } + } + } + +--- a/net/core/scm.c ++++ b/net/core/scm.c +@@ -26,6 +26,7 @@ + #include + #include + #include ++#include + + #include + +@@ -103,6 +104,11 @@ static int scm_fp_copy(struct cmsghdr *c + + if (fd < 0 || !(file = fget_raw(fd))) + return -EBADF; ++ /* don't allow io_uring files */ ++ if (io_uring_get_socket(file)) { ++ fput(file); ++ return -EINVAL; ++ } + *fpp++ = file; + fpl->count++; + } diff --git a/queue-5.15/series b/queue-5.15/series index c8baecef430..8765dc147de 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -104,6 +104,7 @@ tracing-set-actual-size-after-ring-buffer-resize.patch tracing-stop-current-tracer-when-resizing-buffer.patch r8169-fix-rtl8125b-pause-frames-blasting-when-suspen.patch mm-fix-oops-when-filemap_map_pmd-without-prealloc_pte.patch +io_uring-af_unix-disable-sending-io_uring-over-sockets.patch arm64-dts-mediatek-align-thermal-zone-node-names-wit.patch arm64-dts-mediatek-mt8183-move-thermal-zones-to-the-.patch arm64-dts-mediatek-add-missing-space-before.patch -- 2.47.3