io_uring/rsrc: fix rogue rsrc node grabbing

isilence · axboe · commit 4ff0b50de8ca · 2023-03-29T09:23:46.000-06:00
We should not be looking at ctx->rsrc_node and anyhow modifying the node without holding uring_lock, grabbing references in such a way is not safe either. Cc: stable@vger.kernel.org Fixes: 5106dd6 ("io_uring: propagate issue_flags state down to file assignment") Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Link: https://lore.kernel.org/r/1202ede2d7bb90136e3482b2b84aad9ed483e5d6.1680098433.git.asml.silence@gmail.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
diff --git a/io_uring/rsrc.h b/io_uring/rsrc.h
@@ -144,15 +144,13 @@ static inline void io_req_set_rsrc_node(struct io_kiocb *req,
 					unsigned int issue_flags)
 {
 	if (!req->rsrc_node) {
-		req->rsrc_node = ctx->rsrc_node;
+		io_ring_submit_lock(ctx, issue_flags);
 
-		if (!(issue_flags & IO_URING_F_UNLOCKED)) {
-			lockdep_assert_held(&ctx->uring_lock);
+		lockdep_assert_held(&ctx->uring_lock);
 
-			io_charge_rsrc_node(ctx);
-		} else {
-			percpu_ref_get(&req->rsrc_node->refs);
-		}
+		req->rsrc_node = ctx->rsrc_node;
+		io_charge_rsrc_node(ctx);
+		io_ring_submit_unlock(ctx, issue_flags);
 	}
 }
 

Original file line number	Diff line number	Diff line change
`@@ -144,15 +144,13 @@ static inline void io_req_set_rsrc_node(struct io_kiocb *req,`
`144`	`144`	`unsigned int issue_flags)`
`145`	`145`	`{`
`146`	`146`	`if (!req->rsrc_node) {`
`147`		`- req->rsrc_node = ctx->rsrc_node;`
	`147`	`+ io_ring_submit_lock(ctx, issue_flags);`
`148`	`148`
`149`		`- if (!(issue_flags & IO_URING_F_UNLOCKED)) {`
`150`		`- lockdep_assert_held(&ctx->uring_lock);`
	`149`	`+ lockdep_assert_held(&ctx->uring_lock);`
`151`	`150`
`152`		`- io_charge_rsrc_node(ctx);`
`153`		`- } else {`
`154`		`- percpu_ref_get(&req->rsrc_node->refs);`
`155`		`- }`
	`151`	`+ req->rsrc_node = ctx->rsrc_node;`
	`152`	`+ io_charge_rsrc_node(ctx);`
	`153`	`+ io_ring_submit_unlock(ctx, issue_flags);`
`156`	`154`	`}`
`157`	`155`	`}`
`158`	`156`