* [PATCH 5.10 1/1] io_uring: fix double free in the deferred/cancelled path
@ 2021-10-27 8:01 Lee Jones
2021-10-27 8:18 ` Greg KH
0 siblings, 1 reply; 9+ messages in thread
From: Lee Jones @ 2021-10-27 8:01 UTC (permalink / raw)
To: stable, axboe, asml.silence
Cc: io-uring, Lee Jones, syzbot+59d8a1f4e60c20c066cf
792bb6eb86233 ("io_uring: don't take uring_lock during iowq cancel")
inadvertently fixed this issue in v5.12. This patch cherry-picks the
hunk of commit which does so.
Syzbot vomit (snipped):
==================================================================
BUG: KASAN: double-free or invalid-free in slab_free mm/slub.c:3195 [inline]
BUG: KASAN: double-free or invalid-free in kfree+0xca/0x310 mm/slub.c:4183
CPU: 1 PID: 431 Comm: syz-executor823 Not tainted 5.10.75-syzkaller-01082-g234d53d2bb60 #0
Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack_lvl+0x1e2/0x24b lib/dump_stack.c:118
print_address_description+0x8d/0x3d0 mm/kasan/report.c:233
kasan_report_invalid_free+0x58/0x130 mm/kasan/report.c:358
____kasan_slab_free+0x14b/0x170 mm/kasan/common.c:362
__kasan_slab_free+0x11/0x20 mm/kasan/common.c:368
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:1596 [inline]
slab_free_freelist_hook+0xb2/0x180 mm/slub.c:1621
slab_free mm/slub.c:3195 [inline]
kfree+0xca/0x310 mm/slub.c:4183
__io_queue_deferred fs/io_uring.c:1541 [inline]
io_commit_cqring+0x76a/0xa00 fs/io_uring.c:1587
io_iopoll_complete fs/io_uring.c:2378 [inline]
io_do_iopoll+0x1e18/0x23f0 fs/io_uring.c:2431
io_iopoll_try_reap_events+0x116/0x290 fs/io_uring.c:2470
io_ring_ctx_wait_and_kill+0x295/0x670 fs/io_uring.c:8575
io_uring_release+0x5b/0x70 fs/io_uring.c:8602
__fput+0x348/0x7d0 fs/file_table.c:281
____fput+0x15/0x20 fs/file_table.c:314
task_work_run+0x147/0x1b0 kernel/task_work.c:154
exit_task_work include/linux/task_work.h:30 [inline]
do_exit+0x70e/0x23a0 kernel/exit.c:813
do_group_exit+0x16a/0x2d0 kernel/exit.c:910
__do_sys_exit_group+0x17/0x20 kernel/exit.c:921
__se_sys_exit_group+0x14/0x20 kernel/exit.c:919
__x64_sys_exit_group+0x3b/0x40 kernel/exit.c:919
do_syscall_64+0x31/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Cc: stable <[email protected]> # 5.10.x
Reported-by: [email protected]
Signed-off-by: Lee Jones <[email protected]>
---
fs/io_uring.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/io_uring.c b/fs/io_uring.c
index 26753d0cb4312..361f8ae96c36f 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -2075,7 +2075,9 @@ static void io_req_task_cancel(struct callback_head *cb)
struct io_kiocb *req = container_of(cb, struct io_kiocb, task_work);
struct io_ring_ctx *ctx = req->ctx;
+ mutex_lock(&ctx->uring_lock);
__io_req_task_cancel(req, -ECANCELED);
+ mutex_unlock(&ctx->uring_lock);
percpu_ref_put(&ctx->refs);
}
--
2.33.0.1079.g6e70778dc9-goog
^ permalink raw reply related [flat|nested] 9+ messages in thread
* Re: [PATCH 5.10 1/1] io_uring: fix double free in the deferred/cancelled path
2021-10-27 8:01 [PATCH 5.10 1/1] io_uring: fix double free in the deferred/cancelled path Lee Jones
@ 2021-10-27 8:18 ` Greg KH
2021-10-27 8:37 ` Lee Jones
0 siblings, 1 reply; 9+ messages in thread
From: Greg KH @ 2021-10-27 8:18 UTC (permalink / raw)
To: Lee Jones
Cc: stable, axboe, asml.silence, io-uring,
syzbot+59d8a1f4e60c20c066cf
On Wed, Oct 27, 2021 at 09:01:28AM +0100, Lee Jones wrote:
> 792bb6eb86233 ("io_uring: don't take uring_lock during iowq cancel")
> inadvertently fixed this issue in v5.12. This patch cherry-picks the
> hunk of commit which does so.
Why can't we take all of that commit? Why only part of it?
thanks,
greg k-h
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH 5.10 1/1] io_uring: fix double free in the deferred/cancelled path
2021-10-27 8:18 ` Greg KH
@ 2021-10-27 8:37 ` Lee Jones
2021-10-27 8:53 ` Greg KH
0 siblings, 1 reply; 9+ messages in thread
From: Lee Jones @ 2021-10-27 8:37 UTC (permalink / raw)
To: Greg KH; +Cc: stable, axboe, asml.silence, io-uring,
syzbot+59d8a1f4e60c20c066cf
On Wed, 27 Oct 2021, Greg KH wrote:
> On Wed, Oct 27, 2021 at 09:01:28AM +0100, Lee Jones wrote:
> > 792bb6eb86233 ("io_uring: don't take uring_lock during iowq cancel")
> > inadvertently fixed this issue in v5.12. This patch cherry-picks the
> > hunk of commit which does so.
>
> Why can't we take all of that commit? Why only part of it?
I don't know.
Why didn't the Stable team take it further than v5.11.y?
--
Lee Jones [李琼斯]
Senior Technical Lead - Developer Services
Linaro.org │ Open source software for Arm SoCs
Follow Linaro: Facebook | Twitter | Blog
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH 5.10 1/1] io_uring: fix double free in the deferred/cancelled path
2021-10-27 8:37 ` Lee Jones
@ 2021-10-27 8:53 ` Greg KH
2021-10-27 9:03 ` Lee Jones
0 siblings, 1 reply; 9+ messages in thread
From: Greg KH @ 2021-10-27 8:53 UTC (permalink / raw)
To: Lee Jones
Cc: stable, axboe, asml.silence, io-uring,
syzbot+59d8a1f4e60c20c066cf
On Wed, Oct 27, 2021 at 09:37:59AM +0100, Lee Jones wrote:
> On Wed, 27 Oct 2021, Greg KH wrote:
>
> > On Wed, Oct 27, 2021 at 09:01:28AM +0100, Lee Jones wrote:
> > > 792bb6eb86233 ("io_uring: don't take uring_lock during iowq cancel")
> > > inadvertently fixed this issue in v5.12. This patch cherry-picks the
> > > hunk of commit which does so.
> >
> > Why can't we take all of that commit? Why only part of it?
>
> I don't know.
>
> Why didn't the Stable team take it further than v5.11.y?
Look in the archives? Did it not apply cleanly?
/me goes off and looks...
Looks like I asked for a backport, but no one did it, I only received a
5.11 version:
https://lore.kernel.org/r/1839646480a26a2461eccc38a75e98998d2d6e11.1615375332.git.asml.silence@gmail.com
so a 5.10 version would be nice, as I said it failed as-is:
https://lore.kernel.org/all/[email protected]/
lore archives are your friend :)
thanks,
greg k-h
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH 5.10 1/1] io_uring: fix double free in the deferred/cancelled path
2021-10-27 8:53 ` Greg KH
@ 2021-10-27 9:03 ` Lee Jones
2021-10-27 12:46 ` Greg KH
0 siblings, 1 reply; 9+ messages in thread
From: Lee Jones @ 2021-10-27 9:03 UTC (permalink / raw)
To: Greg KH; +Cc: stable, axboe, asml.silence, io-uring,
syzbot+59d8a1f4e60c20c066cf
On Wed, 27 Oct 2021, Greg KH wrote:
> On Wed, Oct 27, 2021 at 09:37:59AM +0100, Lee Jones wrote:
> > On Wed, 27 Oct 2021, Greg KH wrote:
> >
> > > On Wed, Oct 27, 2021 at 09:01:28AM +0100, Lee Jones wrote:
> > > > 792bb6eb86233 ("io_uring: don't take uring_lock during iowq cancel")
> > > > inadvertently fixed this issue in v5.12. This patch cherry-picks the
> > > > hunk of commit which does so.
> > >
> > > Why can't we take all of that commit? Why only part of it?
> >
> > I don't know.
> >
> > Why didn't the Stable team take it further than v5.11.y?
>
> Look in the archives? Did it not apply cleanly?
>
> /me goes off and looks...
>
> Looks like I asked for a backport, but no one did it, I only received a
> 5.11 version:
> https://lore.kernel.org/r/1839646480a26a2461eccc38a75e98998d2d6e11.1615375332.git.asml.silence@gmail.com
>
> so a 5.10 version would be nice, as I said it failed as-is:
> https://lore.kernel.org/all/[email protected]/
Precisely. This is the answer to your question:
> > > Why can't we take all of that commit? Why only part of it?
Same reason the Stable team didn't back-port it - it doesn't apply.
The second hunk is only relevant to v5.11+.
--
Lee Jones [李琼斯]
Senior Technical Lead - Developer Services
Linaro.org │ Open source software for Arm SoCs
Follow Linaro: Facebook | Twitter | Blog
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH 5.10 1/1] io_uring: fix double free in the deferred/cancelled path
2021-10-27 9:03 ` Lee Jones
@ 2021-10-27 12:46 ` Greg KH
2021-10-27 14:00 ` Lee Jones
0 siblings, 1 reply; 9+ messages in thread
From: Greg KH @ 2021-10-27 12:46 UTC (permalink / raw)
To: Lee Jones
Cc: stable, axboe, asml.silence, io-uring,
syzbot+59d8a1f4e60c20c066cf
On Wed, Oct 27, 2021 at 10:03:01AM +0100, Lee Jones wrote:
> On Wed, 27 Oct 2021, Greg KH wrote:
>
> > On Wed, Oct 27, 2021 at 09:37:59AM +0100, Lee Jones wrote:
> > > On Wed, 27 Oct 2021, Greg KH wrote:
> > >
> > > > On Wed, Oct 27, 2021 at 09:01:28AM +0100, Lee Jones wrote:
> > > > > 792bb6eb86233 ("io_uring: don't take uring_lock during iowq cancel")
> > > > > inadvertently fixed this issue in v5.12. This patch cherry-picks the
> > > > > hunk of commit which does so.
> > > >
> > > > Why can't we take all of that commit? Why only part of it?
> > >
> > > I don't know.
> > >
> > > Why didn't the Stable team take it further than v5.11.y?
> >
> > Look in the archives? Did it not apply cleanly?
> >
> > /me goes off and looks...
> >
> > Looks like I asked for a backport, but no one did it, I only received a
> > 5.11 version:
> > https://lore.kernel.org/r/1839646480a26a2461eccc38a75e98998d2d6e11.1615375332.git.asml.silence@gmail.com
> >
> > so a 5.10 version would be nice, as I said it failed as-is:
> > https://lore.kernel.org/all/[email protected]/
>
> Precisely. This is the answer to your question:
>
> > > > Why can't we take all of that commit? Why only part of it?
>
> Same reason the Stable team didn't back-port it - it doesn't apply.
>
> The second hunk is only relevant to v5.11+.
Great, then use the "normal" stable style, but down in the s-o-b area
say "dropped second chunk as it is not relevant to 5.10.y".
thanks,
greg k-h
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH 5.10 1/1] io_uring: fix double free in the deferred/cancelled path
2021-10-27 12:46 ` Greg KH
@ 2021-10-27 14:00 ` Lee Jones
2021-10-27 14:38 ` Greg KH
0 siblings, 1 reply; 9+ messages in thread
From: Lee Jones @ 2021-10-27 14:00 UTC (permalink / raw)
To: Greg KH; +Cc: stable, axboe, asml.silence, io-uring,
syzbot+59d8a1f4e60c20c066cf
On Wed, 27 Oct 2021, Greg KH wrote:
> On Wed, Oct 27, 2021 at 10:03:01AM +0100, Lee Jones wrote:
> > On Wed, 27 Oct 2021, Greg KH wrote:
> >
> > > On Wed, Oct 27, 2021 at 09:37:59AM +0100, Lee Jones wrote:
> > > > On Wed, 27 Oct 2021, Greg KH wrote:
> > > >
> > > > > On Wed, Oct 27, 2021 at 09:01:28AM +0100, Lee Jones wrote:
> > > > > > 792bb6eb86233 ("io_uring: don't take uring_lock during iowq cancel")
> > > > > > inadvertently fixed this issue in v5.12. This patch cherry-picks the
> > > > > > hunk of commit which does so.
> > > > >
> > > > > Why can't we take all of that commit? Why only part of it?
> > > >
> > > > I don't know.
> > > >
> > > > Why didn't the Stable team take it further than v5.11.y?
> > >
> > > Look in the archives? Did it not apply cleanly?
> > >
> > > /me goes off and looks...
> > >
> > > Looks like I asked for a backport, but no one did it, I only received a
> > > 5.11 version:
> > > https://lore.kernel.org/r/1839646480a26a2461eccc38a75e98998d2d6e11.1615375332.git.asml.silence@gmail.com
> > >
> > > so a 5.10 version would be nice, as I said it failed as-is:
> > > https://lore.kernel.org/all/[email protected]/
> >
> > Precisely. This is the answer to your question:
> >
> > > > > Why can't we take all of that commit? Why only part of it?
> >
> > Same reason the Stable team didn't back-port it - it doesn't apply.
> >
> > The second hunk is only relevant to v5.11+.
>
> Great, then use the "normal" stable style, but down in the s-o-b area
> say "dropped second chunk as it is not relevant to 5.10.y".
Just to clarify, by "normal", you mean:
- Take the original patch
- Apply an "[ Upstream commit <id> ]" tag (or similar)
- Remove the hunk that doesn't apply
- Make a note of the aforementioned action
- Submit to Stable
Rather than submitting a bespoke patch. Right?
--
Lee Jones [李琼斯]
Senior Technical Lead - Developer Services
Linaro.org │ Open source software for Arm SoCs
Follow Linaro: Facebook | Twitter | Blog
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH 5.10 1/1] io_uring: fix double free in the deferred/cancelled path
2021-10-27 14:00 ` Lee Jones
@ 2021-10-27 14:38 ` Greg KH
2021-10-27 14:42 ` Lee Jones
0 siblings, 1 reply; 9+ messages in thread
From: Greg KH @ 2021-10-27 14:38 UTC (permalink / raw)
To: Lee Jones
Cc: stable, axboe, asml.silence, io-uring,
syzbot+59d8a1f4e60c20c066cf
On Wed, Oct 27, 2021 at 03:00:20PM +0100, Lee Jones wrote:
> On Wed, 27 Oct 2021, Greg KH wrote:
>
> > On Wed, Oct 27, 2021 at 10:03:01AM +0100, Lee Jones wrote:
> > > On Wed, 27 Oct 2021, Greg KH wrote:
> > >
> > > > On Wed, Oct 27, 2021 at 09:37:59AM +0100, Lee Jones wrote:
> > > > > On Wed, 27 Oct 2021, Greg KH wrote:
> > > > >
> > > > > > On Wed, Oct 27, 2021 at 09:01:28AM +0100, Lee Jones wrote:
> > > > > > > 792bb6eb86233 ("io_uring: don't take uring_lock during iowq cancel")
> > > > > > > inadvertently fixed this issue in v5.12. This patch cherry-picks the
> > > > > > > hunk of commit which does so.
> > > > > >
> > > > > > Why can't we take all of that commit? Why only part of it?
> > > > >
> > > > > I don't know.
> > > > >
> > > > > Why didn't the Stable team take it further than v5.11.y?
> > > >
> > > > Look in the archives? Did it not apply cleanly?
> > > >
> > > > /me goes off and looks...
> > > >
> > > > Looks like I asked for a backport, but no one did it, I only received a
> > > > 5.11 version:
> > > > https://lore.kernel.org/r/1839646480a26a2461eccc38a75e98998d2d6e11.1615375332.git.asml.silence@gmail.com
> > > >
> > > > so a 5.10 version would be nice, as I said it failed as-is:
> > > > https://lore.kernel.org/all/[email protected]/
> > >
> > > Precisely. This is the answer to your question:
> > >
> > > > > > Why can't we take all of that commit? Why only part of it?
> > >
> > > Same reason the Stable team didn't back-port it - it doesn't apply.
> > >
> > > The second hunk is only relevant to v5.11+.
> >
> > Great, then use the "normal" stable style, but down in the s-o-b area
> > say "dropped second chunk as it is not relevant to 5.10.y".
>
> Just to clarify, by "normal", you mean:
>
> - Take the original patch
> - Apply an "[ Upstream commit <id> ]" tag (or similar)
> - Remove the hunk that doesn't apply
> - Make a note of the aforementioned action
> - Submit to Stable
Yes.
> Rather than submitting a bespoke patch. Right?
Correct.
thanks,
greg k-h
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH 5.10 1/1] io_uring: fix double free in the deferred/cancelled path
2021-10-27 14:38 ` Greg KH
@ 2021-10-27 14:42 ` Lee Jones
0 siblings, 0 replies; 9+ messages in thread
From: Lee Jones @ 2021-10-27 14:42 UTC (permalink / raw)
To: Greg KH; +Cc: stable, axboe, asml.silence, io-uring,
syzbot+59d8a1f4e60c20c066cf
On Wed, 27 Oct 2021, Greg KH wrote:
> On Wed, Oct 27, 2021 at 03:00:20PM +0100, Lee Jones wrote:
> > On Wed, 27 Oct 2021, Greg KH wrote:
> >
> > > On Wed, Oct 27, 2021 at 10:03:01AM +0100, Lee Jones wrote:
> > > > On Wed, 27 Oct 2021, Greg KH wrote:
> > > >
> > > > > On Wed, Oct 27, 2021 at 09:37:59AM +0100, Lee Jones wrote:
> > > > > > On Wed, 27 Oct 2021, Greg KH wrote:
> > > > > >
> > > > > > > On Wed, Oct 27, 2021 at 09:01:28AM +0100, Lee Jones wrote:
> > > > > > > > 792bb6eb86233 ("io_uring: don't take uring_lock during iowq cancel")
> > > > > > > > inadvertently fixed this issue in v5.12. This patch cherry-picks the
> > > > > > > > hunk of commit which does so.
> > > > > > >
> > > > > > > Why can't we take all of that commit? Why only part of it?
> > > > > >
> > > > > > I don't know.
> > > > > >
> > > > > > Why didn't the Stable team take it further than v5.11.y?
> > > > >
> > > > > Look in the archives? Did it not apply cleanly?
> > > > >
> > > > > /me goes off and looks...
> > > > >
> > > > > Looks like I asked for a backport, but no one did it, I only received a
> > > > > 5.11 version:
> > > > > https://lore.kernel.org/r/1839646480a26a2461eccc38a75e98998d2d6e11.1615375332.git.asml.silence@gmail.com
> > > > >
> > > > > so a 5.10 version would be nice, as I said it failed as-is:
> > > > > https://lore.kernel.org/all/[email protected]/
> > > >
> > > > Precisely. This is the answer to your question:
> > > >
> > > > > > > Why can't we take all of that commit? Why only part of it?
> > > >
> > > > Same reason the Stable team didn't back-port it - it doesn't apply.
> > > >
> > > > The second hunk is only relevant to v5.11+.
> > >
> > > Great, then use the "normal" stable style, but down in the s-o-b area
> > > say "dropped second chunk as it is not relevant to 5.10.y".
> >
> > Just to clarify, by "normal", you mean:
> >
> > - Take the original patch
> > - Apply an "[ Upstream commit <id> ]" tag (or similar)
> > - Remove the hunk that doesn't apply
> > - Make a note of the aforementioned action
> > - Submit to Stable
>
> Yes.
>
> > Rather than submitting a bespoke patch. Right?
>
> Correct.
Got it, thanks. Wilco.
--
Lee Jones [李琼斯]
Senior Technical Lead - Developer Services
Linaro.org │ Open source software for Arm SoCs
Follow Linaro: Facebook | Twitter | Blog
^ permalink raw reply [flat|nested] 9+ messages in thread
end of thread, other threads:[~2021-10-27 14:42 UTC | newest]
Thread overview: 9+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2021-10-27 8:01 [PATCH 5.10 1/1] io_uring: fix double free in the deferred/cancelled path Lee Jones
2021-10-27 8:18 ` Greg KH
2021-10-27 8:37 ` Lee Jones
2021-10-27 8:53 ` Greg KH
2021-10-27 9:03 ` Lee Jones
2021-10-27 12:46 ` Greg KH
2021-10-27 14:00 ` Lee Jones
2021-10-27 14:38 ` Greg KH
2021-10-27 14:42 ` Lee Jones
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox