diff options
| author | Pavel Begunkov <asml.silence@gmail.com> | 2022-06-13 06:30:06 +0100 |
|---|---|---|
| committer | Pavel Begunkov <asml.silence@gmail.com> | 2022-06-13 09:53:27 +0100 |
| commit | d11d31fc5d8a96f707facee0babdcffaafa38de2 (patch) | |
| tree | ec59fcf6033dbbd60c4856d5e49469fb52a8cc28 /fs/io_uring.c | |
| parent | b0380bf6dad4601d92025841e2b7a135d566c6e3 (diff) | |
io_uring: fix races with buffer table unregister
Fixed buffer table quiesce might unlock ->uring_lock, potentially
letting new requests to be submitted, don't allow those requests to
use the table as they will race with unregistration.
Reported-and-tested-by: van fantasy <g1042620637@gmail.com>
Fixes: bd54b6fe3316ec ("io_uring: implement fixed buffers registration similar to fixed files")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Diffstat (limited to 'fs/io_uring.c')
| -rw-r--r-- | fs/io_uring.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/fs/io_uring.c b/fs/io_uring.c index 00d266746916..be05f375a776 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -10680,12 +10680,19 @@ static void __io_sqe_buffers_unregister(struct io_ring_ctx *ctx) static int io_sqe_buffers_unregister(struct io_ring_ctx *ctx) { + unsigned nr = ctx->nr_user_bufs; int ret; if (!ctx->buf_data) return -ENXIO; + /* + * Quiesce may unlock ->uring_lock, and while it's not held + * prevent new requests using the table. + */ + ctx->nr_user_bufs = 0; ret = io_rsrc_ref_quiesce(ctx->buf_data, ctx); + ctx->nr_user_bufs = nr; if (!ret) __io_sqe_buffers_unregister(ctx); return ret; |