[5.7,069/393] io_uring: fix req->work corruption

Message ID	20200817143822.957271457@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <SRS0=5nKa=B3=vger.kernel.org=stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Pavel Begunkov <asml.silence@gmail.com>, Jens Axboe <axboe@kernel.dk>, Sasha Levin <sashal@kernel.org> Subject: [PATCH 5.7 069/393] io_uring: fix req->work corruption Date: Mon, 17 Aug 2020 17:11:59 +0200 Message-Id: <20200817143822.957271457@linuxfoundation.org> In-Reply-To: <20200817143819.579311991@linuxfoundation.org> References: <20200817143819.579311991@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk
Series	None \| expand [5.7,003/393] io_uring: abstract out task work running [5.7,005/393] ARM: dts: stm32: fix uart7_pins_a comments in stm32mp15-pinctrl [5.7,008/393] x86, sched: Bail out of frequency invariance if turbo frequency is unknown [5.7,009/393] x86, sched: Bail out of frequency invariance if turbo_freq/base_freq gives 0 [5.7,010/393] sched/fair: Fix NOHZ next idle balance [5.7,011/393] sched: correct SD_flags returned by tl->sd_flags() [5.7,012/393] arm64: dts: rockchip: fix rk3368-lion gmac reset gpio [5.7,013/393] arm64: dts: rockchip: fix rk3399-puma vcc5v0-host gpio [5.7,014/393] arm64: dts: rockchip: fix rk3399-puma gmac reset gpio [5.7,017/393] arm64: dts: qcom: msm8916: Replace invalid bias-pull-none property [5.7,018/393] memory: tegra: Fix an error handling path in tegra186_emc_probe() [5.7,020/393] crypto: ccree - fix resource leak on error path [5.7,021/393] ARM: exynos: MCPM: Restore big.LITTLE cpuidle support [5.7,022/393] rcu/tree: Repeat the monitor if any free channel is busy [5.7,023/393] firmware: arm_scmi: Fix SCMI genpd domain probing [5.7,024/393] arm64: dts: sun50i-pinephone: dldo4 must not be >= 1.8V [5.7,026/393] sched/uclamp: Fix initialization of struct uclamp_rq [5.7,027/393] crypto: qat - allow xts requests not multiple of block [5.7,028/393] clk: scmi: Fix min and max rate when registering clocks with discrete rates [5.7,032/393] platform/x86: intel-vbtn: Fix return value check in check_acpi_dev() [5.7,034/393] arm64: dts: renesas: Fix SD Card/eMMC interface device node names [5.7,035/393] ARM: dts: gose: Fix ports node name for adv7612 [5.7,037/393] ARM: dts: exynos: Disable frequency scaling for FSYS bus on Odroid XU3 family [5.7,040/393] ARM: dts: sunxi: bananapi-m2-plus-v1.2: Fix CPU supply voltages [5.7,042/393] tpm: Require that all digests are present in TCG_PCR_EVENT2 structures [5.7,043/393] recordmcount: only record relocation of type R_AARCH64_CALL26 on arm64. [5.7,048/393] spi: rockchip: Fix error in SPI slave pio read [5.7,050/393] iocost: Fix check condition of iocg abs_vdebt [5.7,051/393] scripts/selinux/mdp: fix initial SID handling [5.7,053/393] seccomp: Fix ioctl number for SECCOMP_IOCTL_NOTIF_ID_VALID [5.7,054/393] md: raid0/linear: fix dereference before null check on pointer mddev [5.7,055/393] irqchip/loongson-liointc: Fix potential dead lock [5.7,056/393] irqchip/irq-bcm7038-l1: Guard uses of cpu_logical_map [5.7,060/393] nvme-multipath: fix logic for non-optimized paths [5.7,061/393] nvme-multipath: do not fall back to __nvme_find_path() for non-optimized paths [5.7,062/393] block: dont do revalidate zones on invalid devices [5.7,066/393] ARM: exynos: clear L310_AUX_CTRL_FULL_LINE_ZERO in default l2c_aux_val [5.7,067/393] Bluetooth: add a mutex lock to avoid UAF in do_enale_set [5.7,068/393] loop: be paranoid on exit and prevent new additions / removals [5.7,069/393] io_uring: fix req->work corruption [5.7,070/393] fs/btrfs: Add cond_resched() for try_release_extent_mapping() stalls [5.7,075/393] video: fbdev: neofb: fix memory leak in neo_scan_monitor() [5.7,078/393] drm/nouveau/kms/nv50-: Fix disabling dithering [5.7,079/393] arm64: dts: hisilicon: hikey: fixes to comply with adi, adv7533 DT binding [5.7,080/393] drm/etnaviv: fix ref count leak via pm_runtime_get_sync [5.7,082/393] drm/nouveau: fix reference count leak in nouveau_debugfs_strap_peek [5.7,084/393] mmc: sdhci-cadence: do not use hardware tuning for SD mode [5.7,085/393] btrfs: fix lockdep splat from btrfs_dump_space_info [5.7,087/393] drm: msm: a6xx: fix gpu failure after system resume [5.7,091/393] net: phy: mscc: restore the base page in vsc8514/8584_config_init [5.7,093/393] mm/mmap.c: Add cond_resched() for exit_mmap() CPU stalls [5.7,095/393] drm/amdgpu/display bail early in dm_pp_get_static_clocks [5.7,100/393] brcmfmac: keep SDIO watchdog running when console_interval is non-zero [5.7,101/393] brcmfmac: To fix Bss Info flag definition Bug [5.7,103/393] platform/x86: asus-nb-wmi: add support for ASUS ROG Zephyrus G14 and G15 [5.7,104/393] iwlegacy: Check the return value of pcie_capability_read_*() [5.7,106/393] drm/amd/powerplay: suppress compile error around BUG_ON [5.7,108/393] x86/uaccess: Make __get_user_size() Clang compliant on 32-bit [5.7,109/393] mmc: sdhci-pci-o2micro: Bug fix for O2 host controller Seabird1 [5.7,110/393] usb: gadget: net2280: fix memory leak on probe error handling paths [5.7,112/393] usb: bdc: Halt controller on suspend [5.7,113/393] dyndbg: fix a BUG_ON in ddebug_describe_flags [5.7,117/393] ACPICA: Do not increment operation_region reference counts for field units [5.7,118/393] io_uring: fix racy overflow count reporting [5.7,122/393] drm/gem: Fix a leak in drm_gem_objects_lookup() [5.7,124/393] drm/bridge: ti-sn65dsi86: Fix off-by-one error in clock choice [5.7,125/393] drm/amdgpu: use the unlocked drm_gem_object_put [5.7,129/393] btmrvl: Fix firmware filename for sd8977 chipset [5.7,130/393] btmrvl: Fix firmware filename for sd8997 chipset [5.7,132/393] console: newport_con: fix an issue about leak related system resources [5.7,135/393] Bluetooth: hci_qca: Only remove TX clock vote after TX is completed [5.7,138/393] Bluetooth: hci_qca: Bug fix during SSR timeout [5.7,139/393] Bluetooth: hci_qca: Increase SoC idle timeout to 200ms [5.7,142/393] scsi: ufs: Fix imprecise load calculation in devfreq window [5.7,143/393] drm/etnaviv: Fix error path on failure to enable bus clk [5.7,146/393] clk: bcm63xx-gate: fix last clock availability [5.7,148/393] powerpc/fixmap: Fix FIX_EARLY_DEBUG_BASE when page size is 256k [5.7,149/393] leds: lm355x: avoid enum conversion warning [5.7,151/393] Bluetooth: btmtksdio: fix up firmware download sequence [5.7,152/393] media: cxusb-analog: fix V4L2 dependency [5.7,153/393] media: marvell-ccic: Add missed v4l2_async_notifier_cleanup() [5.7,154/393] media: omap3isp: Add missed v4l2_ctrl_handler_free() for preview_init_entities() [5.7,155/393] staging: most: avoid null pointer dereference when iface is null [5.7,158/393] ASoC: Intel: cml_rt1011_rt5682: add missing .owner field [5.7,160/393] ASoC: Intel: bxt_rt298: add missing .owner field [5.7,161/393] net: atlantic: MACSec offload statistics checkpatch fix [5.7,163/393] drm/mipi: use dcs write for mipi_dsi_dcs_set_tear_scanline [5.7,164/393] cxl: Fix kobject memleak [5.7,165/393] lkdtm: Avoid more compiler optimizations for bad writes [5.7,168/393] net: ethernet: ti: am65-cpsw-nuss: restore vlan configuration while down/up [5.7,172/393] staging: vchiq_arm: Add a matching unregister call [5.7,174/393] iavf: Fix updating statistics [5.7,175/393] RDMA/core: Fix bogus WARN_ON during ib_unregister_device_queued() [5.7,176/393] scsi: powertec: Fix different dev_id between request_irq() and free_irq() [5.7,178/393] ipvs: allow connection reuse for unconfirmed conntrack [5.7,181/393] media: staging: rkisp1: rsz: supported formats are the isps src formats, not sink f... [5.7,183/393] media: tvp5150: Add missed media_entity_cleanup() [5.7,184/393] media: exynos4-is: Add missed check for pinctrl_lookup_state() [5.7,186/393] xfs: dont eat an EIO/ENOSPC writeback error when scrubbing data fork [5.7,188/393] iomap: Make sure iomap_end is called after iomap_begin [5.7,189/393] RDMA/rxe: Skip dgid check in loopback mode [5.7,195/393] drm: panel: simple: Fix bpc for LG LB070WV8 panel [5.7,196/393] phy: exynos5-usbdrd: Calibrating makes sense only for USB2.0 PHY [5.7,198/393] drm/bridge: sil_sii8620: initialize return of sii8620_readb [5.7,199/393] scsi: scsi_debug: Add check for sdebug_max_queue during module init [5.7,200/393] mwifiex: Prevent memory corruption handling keys [5.7,201/393] kernfs: do not call fsnotify() with name without a parent [5.7,204/393] powerpc/vdso: Fix vdso cpu truncation [5.7,207/393] ima: Have the LSM free its audit rule [5.7,210/393] ima: Fail rule parsing when buffer hook functions have an invalid action [5.7,212/393] ima: Fail rule parsing when the KEY_CHECK hook is combined with an invalid cond [5.7,214/393] ASoC: meson: fixes the missed kfree() for axg_card_add_tdm_loopback [5.7,215/393] PCI/ASPM: Add missing newline in sysfs policy [5.7,217/393] media: s5p-g2d: Fix a memory leak in an error handling path in g2d_probe() [5.7,218/393] phy: renesas: rcar-gen3-usb2: move irq registration to init [5.7,222/393] gpu: ipu-v3: Restore RGB32, BGR32 [5.7,223/393] spi: lantiq-ssc: Fix warning by using WQ_MEM_RECLAIM [5.7,224/393] USB: serial: iuu_phoenix: fix led-activity helpers [5.7,225/393] clk: qcom: gcc: Make disp gpll0 branch aon for sc7180/sdm845 [5.7,227/393] thermal: ti-soc-thermal: Fix reversed condition in ti_thermal_expose_sensor() [5.7,228/393] coresight: etmv4: Fix resource selector constant [5.7,229/393] coresight: etmv4: Counter values not saved on disable [5.7,231/393] coresight: etm4x: Fix save/restore during cpu idle [5.7,232/393] powerpc/perf: Fix missing is_sier_aviable() during build [5.7,233/393] mt76: mt7615: fix potential memory leak in mcu message handler [5.7,235/393] phy: armada-38x: fix NETA lockup when repeatedly switching speeds [5.7,237/393] s390/bpf: Use brcl for jumping to exit_ip if necessary [5.7,239/393] tools/bpftool: Fix error handing in do_skeleton() [5.7,240/393] ASoC: tas2770: Fix reset gpio property name [5.7,241/393] ASoC: hdac_hda: fix deadlock after PCM open error [5.7,244/393] usb: dwc2: Fix error path in gadget registration [5.7,246/393] scsi: megaraid_sas: Clear affinity hint [5.7,248/393] net: dsa: mv88e6xxx: MV88E6097 does not support jumbo configuration [5.7,250/393] PCI: cadence: Fix cdns_pcie_{host\|ep}_setup() error path [5.7,251/393] PCI: cadence: Fix updating Vendor ID and Subsystem Vendor ID register [5.7,253/393] Smack: fix another vsscanf out of bounds [5.7,256/393] Bluetooth: btusb: Fix and detect most of the Chinese Bluetooth controllers [5.7,259/393] Bluetooth: Fix suspend notifier race [5.7,260/393] Bluetooth: hci_qca: Stop collecting memdump again for command timeout during SSR [5.7,261/393] net: dsa: rtl8366: Fix VLAN semantics [5.7,262/393] net: dsa: rtl8366: Fix VLAN set-up [5.7,265/393] selftests/powerpc: Squash spurious errors due to device removal [5.7,266/393] powerpc/32s: Fix CONFIG_BOOK3S_601 uses [5.7,268/393] selftests/powerpc: Fix CPU affinity for child process [5.7,271/393] PCI: Release IVRS table in AMD ACS quirk [5.7,273/393] powerpc/pseries/hotplug-cpu: Remove double free in error path [5.7,274/393] selftests/powerpc: Fix online CPU selection [5.7,275/393] ASoC: meson: axg-tdm-interface: fix link fmt setup [5.7,276/393] ASoC: meson: axg-tdmin: fix g12a skew [5.7,277/393] ASoC: meson: axg-tdm-formatters: fix sclk inversion [5.7,278/393] ASoC: soc-core: Fix regression causing sysfs entries to disappear [5.7,280/393] ASoC: fsl_sai: Fix value of FSL_SAI_CR1_RFW_MASK [5.7,282/393] s390/qeth: dont process empty bridge port events [5.7,283/393] ice: Clear and free XLT entries on reset [5.7,285/393] netfilter: nft_meta: fix iifgroup matching [5.7,287/393] rtw88: fix short GI capability based on current bandwidth [5.7,288/393] rtw88: coex: only skip coex triggered by BT info [5.7,289/393] qtnfmac: Missing platform_device_unregister() on error in qtnf_core_mac_alloc() [5.7,291/393] tools, build: Propagate build failures from tools/build/Makefile.build [5.7,292/393] tools, bpftool: Fix wrong return value in do_dump() [5.7,294/393] net/mlx5: Delete extra dump stack that gives nothing [5.7,295/393] ftrace: Fix ftrace_trace_task return value [5.7,299/393] net: spider_net: Fix the size used in a dma_free_coherent() call [5.7,302/393] fsl/fman: fix unreachable code [5.7,304/393] fsl/fman: fix eth hash table allocation [5.7,305/393] gpio: dont use same lockdep class for all devm_gpiochip_add_data users [5.7,307/393] media: mtk-mdp: Fix a refcounting bug on error in init [5.7,309/393] ocfs2: fix unbalanced locking [5.7,313/393] nfsd: avoid a NULL dereference in __cld_pipe_upcall() [5.7,314/393] SUNRPC: Fix ("SUNRPC: Add "@len" parameter to gss_unwrap()") [5.7,316/393] crypto: aesni - add compatibility with IAS [5.7,321/393] net: phy: fix memory leak in device-create error path [5.7,322/393] net: Set fput_needed iff FDPUT_FPUT is set [5.7,323/393] net/tls: Fix kmap usage [5.7,327/393] net: initialize fastreuse on inet_inherit_port [5.7,329/393] net: phy: marvell10g: fix null pointer dereference [5.7,331/393] USB: serial: cp210x: enable usb generic throttle/unthrottle [5.7,332/393] usb: cdns3: gadget: always zeroed TRB buffer when enable endpoint [5.7,334/393] ALSA: hda - fix the micmute led status for Lenovo ThinkCentre AIO [5.7,336/393] ALSA: usb-audio: fix overeager device match for MacroSilicon MS2109 [5.7,340/393] pstore: Fix linking when crypto API disabled [5.7,341/393] crypto: hisilicon - dont sleep of CRYPTO_TFM_REQ_MAY_SLEEP was not specified [5.7,342/393] crypto: qat - fix double free in qat_uclo_create_batch_init_list [5.7,344/393] crypto: cpt - dont sleep of CRYPTO_TFM_REQ_MAY_SLEEP was not specified [5.7,348/393] fs/minix: dont allow getting deleted inodes [5.7,350/393] kvm: x86: replace kvm_spec_ctrl_test_value with runtime test on the host [5.7,352/393] driver core: Fix probe_count imbalance in really_probe() [5.7,353/393] media: media-request: Fix crash if memory allocation fails [5.7,354/393] drm/ttm/nouveau: dont call tt destroy callback on alloc failure. [5.7,355/393] io_uring: set ctx sq/cq entry count earlier [5.7,356/393] io_uring: use TWA_SIGNAL for task_work uncondtionally [5.7,359/393] NFS: Dont return layout segments that are in use [5.7,360/393] cpufreq: Fix locking issues with governors [5.7,361/393] cpufreq: dt: fix oops on armada37xx [5.7,364/393] PM / devfreq: Fix indentaion of devfreq_summary debugfs node [5.7,365/393] spi: spidev: Align buffers for DMA [5.7,366/393] mtd: rawnand: qcom: avoid write to unavailable register [5.7,368/393] erofs: fix extended inode could cross boundary [5.7,370/393] Revert "parisc: Drop LDCW barrier in CAS code when running UP" [5.7,373/393] parisc: Do not use an ordered store in pa_tlb_lock() [5.7,375/393] parisc: mask out enable and reserved bits from sba imask [5.7,376/393] ARM: dts: exynos: Extend all Exynos5800 A15s OPPs with max voltage data [5.7,378/393] firmware: qcom_scm: Fix legacy convention SCM accessors [5.7,379/393] irqdomain/treewide: Free firmware node after domain removal [5.7,385/393] s390/dasd: fix inability to use DASD with DIAG driver [5.7,386/393] s390/numa: set node distance to LOCAL_DISTANCE [5.7,390/393] task_work: only grab task signal lock when needed [5.7,392/393] io_uring: enable lookup of links holding inflight files [5.7,393/393] io_uring: hold ctx reference around task_work queue + execute

Message ID

20200817143822.957271457@linuxfoundation.org

State

Superseded

Headers

From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Pavel Begunkov <asml.silence@gmail.com>,
	Jens Axboe <axboe@kernel.dk>, Sasha Levin <sashal@kernel.org>
Subject: [PATCH 5.7 069/393] io_uring: fix req->work corruption
Date: Mon, 17 Aug 2020 17:11:59 +0200
Message-Id: <20200817143822.957271457@linuxfoundation.org>
In-Reply-To: <20200817143819.579311991@linuxfoundation.org>
References: <20200817143819.579311991@linuxfoundation.org>
User-Agent: quilt/0.66
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Sender: stable-owner@vger.kernel.org
Precedence: bulk

Series

None | expand

Commit Message

Greg Kroah-Hartman Aug. 17, 2020, 3:11 p.m. UTC

From: Pavel Begunkov <asml.silence@gmail.com>

[ Upstream commit 8ef77766ba8694968ed4ba24311b4bacee14f235 ]

req->work and req->task_work are in a union, so io_req_task_queue() screws
everything that was in work. De-union them for now.

[  704.367253] BUG: unable to handle page fault for address:
	ffffffffaf7330d0
[  704.367256] #PF: supervisor write access in kernel mode
[  704.367256] #PF: error_code(0x0003) - permissions violation
[  704.367261] CPU: 6 PID: 1654 Comm: io_wqe_worker-0 Tainted: G
I       5.8.0-rc2-00038-ge28d0bdc4863-dirty #498
[  704.367265] RIP: 0010:_raw_spin_lock+0x1e/0x36
...
[  704.367276]  __alloc_fd+0x35/0x150
[  704.367279]  __get_unused_fd_flags+0x25/0x30
[  704.367280]  io_openat2+0xcb/0x1b0
[  704.367283]  io_issue_sqe+0x36a/0x1320
[  704.367294]  io_wq_submit_work+0x58/0x160
[  704.367295]  io_worker_handle_work+0x2a3/0x430
[  704.367296]  io_wqe_worker+0x2a0/0x350
[  704.367301]  kthread+0x136/0x180
[  704.367304]  ret_from_fork+0x22/0x30

Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/io_uring.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 04694f6c30a04..159338b5f8263 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -645,12 +645,12 @@  struct io_kiocb {
 		 * restore the work, if needed.
 		 */
 		struct {
-			struct callback_head	task_work;
 			struct hlist_node	hash_node;
 			struct async_poll	*apoll;
 		};
 		struct io_wq_work	work;
 	};
+	struct callback_head	task_work;
 };
 
 #define IO_PLUG_THRESHOLD		2

[5.7,069/393] io_uring: fix req->work corruption

Commit Message

Patch