From 41a4774d8b9d56c4ecb9c09004ee1f1e908a04dd Mon Sep 17 00:00:00 2001 From: Jens Axboe Date: Mon, 19 Sep 2022 19:58:00 +0200 Subject: [PATCH] io_uring: remove poll entry from list when canceling all [ upstream commmit 61bc84c4008812d784c398cfb54118c1ba396dfc ] When the ring is exiting, as part of the shutdown, poll requests are removed. But io_poll_remove_all() does not remove entries when finding them, and since completions are done out-of-band, we can find and remove the same entry multiple times. We do guard the poll execution by poll ownership, but that does not exclude us from reissuing a new one once the previous removal ownership goes away. This can race with poll execution as well, where we then end up seeing req->apoll be NULL because a previous task_work requeue finished the request. Remove the poll entry when we find it and get ownership of it. This prevents multiple invocations from finding it. Fixes: aa43477b0402 ("io_uring: poll rework") Reported-by: Dylan Yudaken Signed-off-by: Jens Axboe [pavel: backport] Signed-off-by: Pavel Begunkov Signed-off-by: Greg Kroah-Hartman (cherry picked from commit 7524ec52caa893a3aeae85488f19dc2f71c8e7b9 linux-5.15.y) CVE-2022-3176 Signed-off-by: Thadeu Lima de Souza Cascardo Acked-by: Stefan Bader Acked-by: Kamal Mostafa Signed-off-by: Stefan Bader --- fs/io_uring.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/io_uring.c b/fs/io_uring.c index bc4741061258..dd750d6f00fd 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -5720,6 +5720,7 @@ static bool io_poll_remove_all(struct io_ring_ctx *ctx, struct task_struct *tsk, list = &ctx->cancel_hash[i]; hlist_for_each_entry_safe(req, tmp, list, hash_node) { if (io_match_task_safe(req, tsk, cancel_all)) { + hlist_del_init(&req->hash_node); io_poll_cancel_req(req); found = true; } -- 2.39.2