All of lore.kernel.org
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	syzbot+6879187cf57845801267@syzkaller.appspotmail.com,
	Pavel Begunkov <asml.silence@gmail.com>,
	Jens Axboe <axboe@kernel.dk>
Subject: [PATCH 5.10 13/54] io_uring: fix list corruption for splice file_get
Date: Thu, 11 Feb 2021 16:01:57 +0100	[thread overview]
Message-ID: <20210211150153.456426866@linuxfoundation.org> (raw)
In-Reply-To: <20210211150152.885701259@linuxfoundation.org>

From: Pavel Begunkov <asml.silence@gmail.com>

[ Upstream commit f609cbb8911e40e15f9055e8f945f926ac906924 ]

kernel BUG at lib/list_debug.c:29!
Call Trace:
 __list_add include/linux/list.h:67 [inline]
 list_add include/linux/list.h:86 [inline]
 io_file_get+0x8cc/0xdb0 fs/io_uring.c:6466
 __io_splice_prep+0x1bc/0x530 fs/io_uring.c:3866
 io_splice_prep fs/io_uring.c:3920 [inline]
 io_req_prep+0x3546/0x4e80 fs/io_uring.c:6081
 io_queue_sqe+0x609/0x10d0 fs/io_uring.c:6628
 io_submit_sqe fs/io_uring.c:6705 [inline]
 io_submit_sqes+0x1495/0x2720 fs/io_uring.c:6953
 __do_sys_io_uring_enter+0x107d/0x1f30 fs/io_uring.c:9353
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

io_file_get() may be called from splice, and so REQ_F_INFLIGHT may
already be set.

Fixes: 02a13674fa0e8 ("io_uring: account io_uring internal files as REQ_F_INFLIGHT")
Cc: stable@vger.kernel.org # 5.9+
Reported-by: syzbot+6879187cf57845801267@syzkaller.appspotmail.com
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/io_uring.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -6170,7 +6170,8 @@ static struct file *io_file_get(struct i
 		file = __io_file_get(state, fd);
 	}
 
-	if (file && file->f_op == &io_uring_fops) {
+	if (file && file->f_op == &io_uring_fops &&
+	    !(req->flags & REQ_F_INFLIGHT)) {
 		io_req_init_async(req);
 		req->flags |= REQ_F_INFLIGHT;
 



  parent reply	other threads:[~2021-02-11 16:19 UTC|newest]

Thread overview: 68+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-02-11 15:01 [PATCH 5.10 00/54] 5.10.16-rc1 review Greg Kroah-Hartman
2021-02-11 15:01 ` [PATCH 5.10 01/54] io_uring: simplify io_task_match() Greg Kroah-Hartman
2021-02-11 15:01 ` [PATCH 5.10 02/54] io_uring: add a {task,files} pair matching helper Greg Kroah-Hartman
2021-02-11 15:01 ` [PATCH 5.10 03/54] io_uring: dont iterate io_uring_cancel_files() Greg Kroah-Hartman
2021-02-11 15:01 ` [PATCH 5.10 04/54] io_uring: pass files into kill timeouts/poll Greg Kroah-Hartman
2021-02-11 15:01 ` [PATCH 5.10 05/54] io_uring: always batch cancel in *cancel_files() Greg Kroah-Hartman
2021-02-11 15:01 ` [PATCH 5.10 06/54] io_uring: fix files cancellation Greg Kroah-Hartman
2021-02-11 15:01 ` [PATCH 5.10 07/54] io_uring: account io_uring internal files as REQ_F_INFLIGHT Greg Kroah-Hartman
2021-02-11 15:01 ` [PATCH 5.10 08/54] io_uring: if we see flush on exit, cancel related tasks Greg Kroah-Hartman
2021-02-11 15:01 ` [PATCH 5.10 09/54] io_uring: fix __io_uring_files_cancel() with TASK_UNINTERRUPTIBLE Greg Kroah-Hartman
2021-02-11 15:01 ` [PATCH 5.10 10/54] io_uring: replace inflight_wait with tctx->wait Greg Kroah-Hartman
2021-02-11 15:01 ` [PATCH 5.10 11/54] io_uring: fix cancellation taking mutex while TASK_UNINTERRUPTIBLE Greg Kroah-Hartman
2021-02-11 15:01 ` [PATCH 5.10 12/54] io_uring: fix flush cqring overflow list while TASK_INTERRUPTIBLE Greg Kroah-Hartman
2021-02-11 15:01 ` Greg Kroah-Hartman [this message]
2021-02-11 15:01 ` [PATCH 5.10 14/54] io_uring: fix sqo ownership false positive warning Greg Kroah-Hartman
2021-02-11 15:01 ` [PATCH 5.10 15/54] io_uring: reinforce cancel on flush during exit Greg Kroah-Hartman
2021-02-11 15:02 ` [PATCH 5.10 16/54] io_uring: drop mm/files between task_work_submit Greg Kroah-Hartman
2021-02-11 15:02 ` [PATCH 5.10 17/54] gpiolib: cdev: clear debounce period if line set to output Greg Kroah-Hartman
2021-02-11 15:02 ` [PATCH 5.10 18/54] powerpc/64/signal: Fix regression in __kernel_sigtramp_rt64() semantics Greg Kroah-Hartman
2021-02-11 15:02 ` [PATCH 5.10 19/54] af_key: relax availability checks for skb size calculation Greg Kroah-Hartman
2021-02-11 15:02 ` [PATCH 5.10 20/54] regulator: core: avoid regulator_resolve_supply() race condition Greg Kroah-Hartman
2021-02-11 15:02 ` [PATCH 5.10 21/54] ASoC: wm_adsp: Fix control name parsing for multi-fw Greg Kroah-Hartman
2021-02-11 15:02 ` [PATCH 5.10 22/54] drm/nouveau/nvif: fix method count when pushing an array Greg Kroah-Hartman
2021-02-11 15:02 ` [PATCH 5.10 23/54] mac80211: 160MHz with extended NSS BW in CSA Greg Kroah-Hartman
2021-02-11 15:02 ` [PATCH 5.10 24/54] ASoC: Intel: Skylake: Zero snd_ctl_elem_value Greg Kroah-Hartman
2021-02-11 15:02 ` [PATCH 5.10 25/54] chtls: Fix potential resource leak Greg Kroah-Hartman
2021-02-11 15:02 ` [PATCH 5.10 26/54] pNFS/NFSv4: Try to return invalid layout in pnfs_layout_process() Greg Kroah-Hartman
2021-02-11 15:02 ` [PATCH 5.10 27/54] pNFS/NFSv4: Improve rejection of out-of-order layouts Greg Kroah-Hartman
2021-02-11 15:02 ` [PATCH 5.10 28/54] ALSA: hda: intel-dsp-config: add PCI id for TGL-H Greg Kroah-Hartman
2021-02-11 15:02 ` [PATCH 5.10 29/54] ASoC: ak4458: correct reset polarity Greg Kroah-Hartman
2021-02-11 15:02 ` [PATCH 5.10 30/54] ASoC: Intel: sof_sdw: set proper flags for Dell TGL-H SKU 0A5E Greg Kroah-Hartman
2021-02-11 15:02 ` [PATCH 5.10 31/54] iwlwifi: mvm: skip power command when unbinding vif during CSA Greg Kroah-Hartman
2021-02-11 15:02 ` [PATCH 5.10 32/54] iwlwifi: mvm: take mutex for calling iwl_mvm_get_sync_time() Greg Kroah-Hartman
2021-02-11 15:02 ` [PATCH 5.10 33/54] iwlwifi: pcie: add a NULL check in iwl_pcie_txq_unmap Greg Kroah-Hartman
2021-02-11 15:02 ` [PATCH 5.10 34/54] iwlwifi: pcie: fix context info memory leak Greg Kroah-Hartman
2021-02-11 15:02 ` [PATCH 5.10 35/54] iwlwifi: mvm: invalidate IDs of internal stations at mvm start Greg Kroah-Hartman
2021-02-11 15:02 ` [PATCH 5.10 36/54] iwlwifi: pcie: add rules to match Qu with Hr2 Greg Kroah-Hartman
2021-02-11 15:02 ` [PATCH 5.10 37/54] iwlwifi: mvm: guard against device removal in reprobe Greg Kroah-Hartman
2021-02-11 15:02 ` [PATCH 5.10 38/54] iwlwifi: queue: bail out on invalid freeing Greg Kroah-Hartman
2021-02-11 15:02 ` [PATCH 5.10 39/54] SUNRPC: Move simple_get_bytes and simple_get_netobj into private header Greg Kroah-Hartman
2021-02-11 15:02 ` [PATCH 5.10 40/54] SUNRPC: Handle 0 length opaque XDR object data properly Greg Kroah-Hartman
2021-02-11 15:02 ` [PATCH 5.10 41/54] i2c: mediatek: Move suspend and resume handling to NOIRQ phase Greg Kroah-Hartman
2021-02-11 15:02 ` [PATCH 5.10 42/54] blk-cgroup: Use cond_resched() when destroy blkgs Greg Kroah-Hartman
2021-02-11 15:02 ` [PATCH 5.10 43/54] regulator: Fix lockdep warning resolving supplies Greg Kroah-Hartman
2021-02-11 15:02 ` [PATCH 5.10 44/54] bpf: Fix verifier jmp32 pruning decision logic Greg Kroah-Hartman
2021-02-11 15:02 ` [PATCH 5.10 45/54] bpf: Fix 32 bit src register truncation on div/mod Greg Kroah-Hartman
2021-02-11 15:02 ` [PATCH 5.10 46/54] bpf: Fix verifier jsgt branch analysis on max bound Greg Kroah-Hartman
2021-02-11 15:02 ` [PATCH 5.10 47/54] drm/i915: Fix ICL MG PHY vswing handling Greg Kroah-Hartman
2021-02-11 15:02 ` [PATCH 5.10 48/54] drm/i915: Skip vswing programming for TBT Greg Kroah-Hartman
2021-02-11 15:02 ` [PATCH 5.10 49/54] nilfs2: make splice write available again Greg Kroah-Hartman
2021-02-11 15:02 ` [PATCH 5.10 50/54] Revert "mm: memcontrol: avoid workload stalls when lowering memory.high" Greg Kroah-Hartman
2021-02-11 15:02 ` [PATCH 5.10 51/54] squashfs: avoid out of bounds writes in decompressors Greg Kroah-Hartman
2021-02-11 15:02 ` [PATCH 5.10 52/54] squashfs: add more sanity checks in id lookup Greg Kroah-Hartman
2021-02-11 15:02 ` [PATCH 5.10 53/54] squashfs: add more sanity checks in inode lookup Greg Kroah-Hartman
2021-02-11 15:02 ` [PATCH 5.10 54/54] squashfs: add more sanity checks in xattr id lookup Greg Kroah-Hartman
2021-02-12  3:16 ` [PATCH 5.10 00/54] 5.10.16-rc1 review Naresh Kamboju
2021-02-13 12:58   ` Greg Kroah-Hartman
2021-02-12 16:17 ` Shuah Khan
2021-02-13 12:58   ` Greg Kroah-Hartman
2021-02-17 22:45     ` Shuah Khan
2021-02-12 18:08 ` Guenter Roeck
2021-02-13 12:58   ` Greg Kroah-Hartman
2021-02-12 19:21 ` Florian Fainelli
2021-02-13 12:58   ` Greg Kroah-Hartman
2021-02-12 19:54 ` Pavel Machek
2021-02-13 12:58   ` Greg Kroah-Hartman
2021-02-13  3:20 ` Ross Schmidt
2021-02-13 12:57   ` Greg Kroah-Hartman

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210211150153.456426866@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=asml.silence@gmail.com \
    --cc=axboe@kernel.dk \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=syzbot+6879187cf57845801267@syzkaller.appspotmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.