[PATCH 5.13] io_uring: fortify tctx/io_wq cleanup

[PATCH 5.13] io_uring: fortify tctx/io_wq cleanup

[Pavel Begunkov]

We don't want anyone poking into tctx->io_wq awhile it's being destroyed
by io_wq_put_and_exit(), and even though it shouldn't even happen, if
buggy would be preferable to get a NULL-deref instead of subtle delayed
failure or UAF.

Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
---
 fs/io_uring.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 89ec10471b30..5f82954004f6 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -9035,15 +9035,15 @@ static void io_uring_del_task_file(unsigned long index)
 
 static void io_uring_clean_tctx(struct io_uring_task *tctx)
 {
+	struct io_wq *wq = tctx->io_wq;
 	struct io_tctx_node *node;
 	unsigned long index;
 
+	tctx->io_wq = NULL;
 	xa_for_each(&tctx->xa, index, node)
 		io_uring_del_task_file(index);
-	if (tctx->io_wq) {
-		io_wq_put_and_exit(tctx->io_wq);
-		tctx->io_wq = NULL;
-	}
+	if (wq)
+		io_wq_put_and_exit(wq);
 }
 
 static s64 tctx_inflight(struct io_uring_task *tctx, bool tracked)
-- 
2.31.1

Re: [PATCH 5.13] io_uring: fortify tctx/io_wq cleanup

[Jens Axboe]

On 5/20/21 6:21 AM, Pavel Begunkov wrote:
> We don't want anyone poking into tctx->io_wq awhile it's being destroyed
> by io_wq_put_and_exit(), and even though it shouldn't even happen, if
> buggy would be preferable to get a NULL-deref instead of subtle delayed
> failure or UAF.

Applied, thanks.

-- 
Jens Axboe