From d71f79a660c280e3f1b4b284bc244c670aefeb80 Mon Sep 17 00:00:00 2001 From: Pavel Begunkov Date: Thu, 14 Jul 2022 21:58:59 +0800 Subject: [PATCH] io_uring: don't touch scm_fp_list after queueing skb stable inclusion from stable-v5.10.111 commit aed30a2054060e470db02eaaf352c14dc38aa611 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5GL1Z Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=aed30a2054060e470db02eaaf352c14dc38aa611 -------------------------------- [ Upstream commit a07211e3001435fe8591b992464cd8d5e3c98c5a ] It's safer to not touch scm_fp_list after we queued an skb to which it was assigned, there might be races lurking if we screw subtle sync guarantees on the io_uring side. Fixes: 6b06314c47e14 ("io_uring: add file set registration") Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe Signed-off-by: Sasha Levin Signed-off-by: Zheng Zengkai Reviewed-by: Wei Li --- fs/io_uring.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/fs/io_uring.c b/fs/io_uring.c index 98410df8a11c..23afe8fd0156 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -7311,8 +7311,12 @@ static int __io_sqe_files_scm(struct io_ring_ctx *ctx, int nr, int offset) refcount_add(skb->truesize, &sk->sk_wmem_alloc); skb_queue_head(&sk->sk_receive_queue, skb); - for (i = 0; i < nr_files; i++) - fput(fpl->fp[i]); + for (i = 0; i < nr; i++) { + struct file *file = io_file_from_index(ctx, i + offset); + + if (file) + fput(file); + } } else { kfree_skb(skb); free_uid(fpl->user); -- GitLab