xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

io_uring: Convert personality_idr to XArray

Browse Source 
commit 61cf93700fe6359552848ed5e3becba6cd760efa upstream.

You can't call idr_remove() from within a idr_for_each() callback,
but you can call xa_erase() from an xa_for_each() loop, so switch the
entire personality_idr from the IDR to the XArray.  This manifests as a
use-after-free as idr_for_each() attempts to walk the rest of the node
after removing the last entry from it.

Fixes: 071698e13a ("io_uring: allow registering credentials")
Cc: stable@vger.kernel.org # 5.6+
Reported-by: yangerkun <yangerkun@huawei.com>
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
[Pavel: rebased (creds load was moved into io_init_req())]
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/7ccff36e1375f2b0ebf73d957f037b43becc0dde.1615212806.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Hanjun Guo <guohanjun@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Matthew Wilcox (Oracle)
2021-07-13 17:18:34 +08:00
committed by Greg Kroah-Hartman
parent cb2985feb1
commit c5a50a220a
1 changed files with 30 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

59
fs/io_uring.c
View File

@@ -346,7 +346,8 @@ struct io_ring_ctx {
struct idr io_buffer_idr; struct idr io_buffer_idr;
struct idr personality_idr; struct xarray personalities;
u32 pers_next;
struct { struct {
unsigned cached_cq_tail; unsigned cached_cq_tail;
@@ -1212,7 +1213,7 @@ static struct io_ring_ctx *io_ring_ctx_alloc(struct io_uring_params *p)
init_completion(&ctx->ref_comp); init_completion(&ctx->ref_comp);
init_completion(&ctx->sq_thread_comp); init_completion(&ctx->sq_thread_comp);
idr_init(&ctx->io_buffer_idr); idr_init(&ctx->io_buffer_idr);
idr_init(&ctx->personality_idr); xa_init_flags(&ctx->personalities, XA_FLAGS_ALLOC1);
mutex_init(&ctx->uring_lock); mutex_init(&ctx->uring_lock);
init_waitqueue_head(&ctx->wait); init_waitqueue_head(&ctx->wait);
spin_lock_init(&ctx->completion_lock); spin_lock_init(&ctx->completion_lock);
@@ -6629,7 +6630,7 @@ static int io_init_req(struct io_ring_ctx *ctx, struct io_kiocb *req,
if (id) { if (id) {
struct io_identity *iod; struct io_identity *iod;
iod = idr_find(&ctx->personality_idr, id); iod = xa_load(&ctx->personalities, id);
if (unlikely(!iod)) if (unlikely(!iod))
return -EINVAL; return -EINVAL;
refcount_inc(&iod->count); refcount_inc(&iod->count);
@@ -8445,7 +8446,6 @@ static void io_ring_ctx_free(struct io_ring_ctx *ctx)
io_sqe_files_unregister(ctx); io_sqe_files_unregister(ctx);
io_eventfd_unregister(ctx); io_eventfd_unregister(ctx);
io_destroy_buffers(ctx); io_destroy_buffers(ctx);
idr_destroy(&ctx->personality_idr);
#if defined(CONFIG_UNIX) #if defined(CONFIG_UNIX)
if (ctx->ring_sock) { if (ctx->ring_sock) {
@@ -8509,7 +8509,7 @@ static int io_unregister_personality(struct io_ring_ctx *ctx, unsigned id)
{ {
struct io_identity *iod; struct io_identity *iod;
iod = idr_remove(&ctx->personality_idr, id); iod = xa_erase(&ctx->personalities, id);
if (iod) { if (iod) {
put_cred(iod->creds); put_cred(iod->creds);
if (refcount_dec_and_test(&iod->count)) if (refcount_dec_and_test(&iod->count))
@@ -8520,14 +8520,6 @@ static int io_unregister_personality(struct io_ring_ctx *ctx, unsigned id)
return -EINVAL; return -EINVAL;
} }
static int io_remove_personalities(int id, void *p, void *data)
{
struct io_ring_ctx *ctx = data;
io_unregister_personality(ctx, id);
return 0;
}
static void io_ring_exit_work(struct work_struct *work) static void io_ring_exit_work(struct work_struct *work)
{ {
struct io_ring_ctx *ctx = container_of(work, struct io_ring_ctx, struct io_ring_ctx *ctx = container_of(work, struct io_ring_ctx,
@@ -8554,6 +8546,9 @@ static bool io_cancel_ctx_cb(struct io_wq_work *work, void *data)
static void io_ring_ctx_wait_and_kill(struct io_ring_ctx *ctx) static void io_ring_ctx_wait_and_kill(struct io_ring_ctx *ctx)
{ {
unsigned long index;
struct io_identify *iod;
mutex_lock(&ctx->uring_lock); mutex_lock(&ctx->uring_lock);
percpu_ref_kill(&ctx->refs); percpu_ref_kill(&ctx->refs);
/* if force is set, the ring is going away. always drop after that */ /* if force is set, the ring is going away. always drop after that */
@@ -8574,7 +8569,8 @@ static void io_ring_ctx_wait_and_kill(struct io_ring_ctx *ctx)
/* if we failed setting up the ctx, we might not have any rings */ /* if we failed setting up the ctx, we might not have any rings */
io_iopoll_try_reap_events(ctx); io_iopoll_try_reap_events(ctx);
idr_for_each(&ctx->personality_idr, io_remove_personalities, ctx); xa_for_each(&ctx->personalities, index, iod)
io_unregister_personality(ctx, index);
/* /*
* Do this upfront, so we won't have a grace period where the ring * Do this upfront, so we won't have a grace period where the ring
@@ -9137,11 +9133,10 @@ out_fput:
} }
#ifdef CONFIG_PROC_FS #ifdef CONFIG_PROC_FS
static int io_uring_show_cred(int id, void *p, void *data) static int io_uring_show_cred(struct seq_file *m, unsigned int id,
const struct io_identity *iod)
{ {
struct io_identity *iod = p;
const struct cred *cred = iod->creds; const struct cred *cred = iod->creds;
struct seq_file *m = data;
struct user_namespace *uns = seq_user_ns(m); struct user_namespace *uns = seq_user_ns(m);
struct group_info *gi; struct group_info *gi;
kernel_cap_t cap; kernel_cap_t cap;
@@ -9209,9 +9204,13 @@ static void __io_uring_show_fdinfo(struct io_ring_ctx *ctx, struct seq_file *m)
seq_printf(m, "%5u: 0x%llx/%u\n", i, buf->ubuf, seq_printf(m, "%5u: 0x%llx/%u\n", i, buf->ubuf,
(unsigned int) buf->len); (unsigned int) buf->len);
} }
if (has_lock && !idr_is_empty(&ctx->personality_idr)) { if (has_lock && !xa_empty(&ctx->personalities)) {
unsigned long index;
const struct io_identity *iod;
seq_printf(m, "Personalities:\n"); seq_printf(m, "Personalities:\n");
idr_for_each(&ctx->personality_idr, io_uring_show_cred, m); xa_for_each(&ctx->personalities, index, iod)
io_uring_show_cred(m, index, iod);
} }
seq_printf(m, "PollList:\n"); seq_printf(m, "PollList:\n");
spin_lock_irq(&ctx->completion_lock); spin_lock_irq(&ctx->completion_lock);
@@ -9597,21 +9596,23 @@ out:
static int io_register_personality(struct io_ring_ctx *ctx) static int io_register_personality(struct io_ring_ctx *ctx)
{ {
struct io_identity *id; struct io_identity *iod;
u32 id;
int ret; int ret;
id = kmalloc(sizeof(*id), GFP_KERNEL); iod = kmalloc(sizeof(*iod), GFP_KERNEL);
if (unlikely(!id)) if (unlikely(!iod))
return -ENOMEM; return -ENOMEM;
io_init_identity(id); io_init_identity(iod);
id->creds = get_current_cred(); iod->creds = get_current_cred();
ret = idr_alloc_cyclic(&ctx->personality_idr, id, 1, USHRT_MAX, GFP_KERNEL); ret = xa_alloc_cyclic(&ctx->personalities, &id, (void *)iod,
if (ret < 0) { XA_LIMIT(0, USHRT_MAX), &ctx->pers_next, GFP_KERNEL);
put_cred(id->creds); if (!ret)
kfree(id); return id;
} put_cred(iod->creds);
kfree(iod);
return ret; return ret;
} }