tmakin/ack-tegra
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

io_uring/rsrc: require cloned buffers to share accounting contexts

Browse Source 
Commit 19d340a2988d4f3e673cded9dde405d727d7e248 upstream.

When IORING_REGISTER_CLONE_BUFFERS is used to clone buffers from uring
instance A to uring instance B, where A and B use different MMs for
accounting, the accounting can go wrong:
If uring instance A is closed before uring instance B, the pinned memory
counters for uring instance B will be decremented, even though the pinned
memory was originally accounted through uring instance A; so the MM of
uring instance B can end up with negative locked memory.

Cc: stable@vger.kernel.org
Closes: https://lore.kernel.org/r/CAG48ez1zez4bdhmeGLEFxtbFADY4Czn3CV0u9d_TMcbvRA01bg@mail.gmail.com
Fixes: 7cc2a6eadc ("io_uring: add IORING_REGISTER_COPY_BUFFERS method")
Signed-off-by: Jann Horn <jannh@google.com>
Link: https://lore.kernel.org/r/20250114-uring-check-accounting-v1-1-42e4145aa743@google.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Jann Horn
2025-01-14 18:49:00 +01:00
committed by Greg Kroah-Hartman
parent 5d114fa2b6
commit efd96fbe23
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
io_uring/rsrc.c
+7
View File
@@ -1153,6 +1153,13 @@ static int io_clone_buffers(struct io_ring_ctx *ctx, struct io_ring_ctx *src_ctx
struct io_rsrc_data *data; struct io_rsrc_data *data;
int i, ret, nbufs; int i, ret, nbufs;
/*
* Accounting state is shared between the two rings; that only works if
* both rings are accounted towards the same counters.
*/
if (ctx->user != src_ctx->user || ctx->mm_account != src_ctx->mm_account)
return -EINVAL;
/* /*
* Drop our own lock here. We'll setup the data we need and reference * Drop our own lock here. We'll setup the data we need and reference
* the source buffers, then re-grab, check, and assign at the end. * the source buffers, then re-grab, check, and assign at the end.