[5.10,073/137] io_uring: fix link timeout refs

Message ID	20210608175944.829057777@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, syzbot+a2910119328ce8e7996f@syzkaller.appspotmail.com, Pavel Begunkov <asml.silence@gmail.com>, Jens Axboe <axboe@kernel.dk>, Sasha Levin <sashal@kernel.org> Subject: [PATCH 5.10 073/137] io_uring: fix link timeout refs Date: Tue, 8 Jun 2021 20:26:53 +0200 Message-Id: <20210608175944.829057777@linuxfoundation.org> In-Reply-To: <20210608175942.377073879@linuxfoundation.org> References: <20210608175942.377073879@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.10,002/137] net: usb: cdc_ncm: dont spew notifications [5.10,003/137] hwmon: (dell-smm-hwmon) Fix index values [5.10,004/137] hwmon: (pmbus/isl68137) remove READ_TEMPERATURE_3 for RAA228228 [5.10,005/137] netfilter: conntrack: unregister ipv4 sockopts on error unwind [5.10,006/137] efi/fdt: fix panic when no valid fdt found [5.10,007/137] efi: Allow EFI_MEMORY_XP and EFI_MEMORY_RO both to be cleared [5.10,008/137] efi/libstub: prevent read overflow in find_file_option() [5.10,009/137] efi: cper: fix snprintf() use in cper_dimm_err_location() [5.10,010/137] vfio/pci: Fix error return code in vfio_ecap_init() [5.10,011/137] vfio/pci: zap_vma_ptes() needs MMU [5.10,012/137] samples: vfio-mdev: fix error handing in mdpy_fb_probe() [5.10,013/137] vfio/platform: fix module_put call in error flow [5.10,014/137] ipvs: ignore IP_VS_SVC_F_HASHED flag when adding service [5.10,015/137] HID: logitech-hidpp: initialize level variable [5.10,016/137] HID: pidff: fix error return code in hid_pidff_init() [5.10,017/137] HID: i2c-hid: fix format string mismatch [5.10,018/137] devlink: Correct VIRTUAL port to not have phys_port attributes [5.10,019/137] net/sched: act_ct: Offload connections with commit action [5.10,020/137] net/sched: act_ct: Fix ct template allocation for zone 0 [5.10,021/137] mptcp: always parse mptcp options for MPC reqsk [5.10,022/137] nvme-rdma: fix in-casule data send for chained sgls [5.10,023/137] ACPICA: Clean up context mutex during object deletion [5.10,024/137] perf probe: Fix NULL pointer dereference in convert_variable_location() [5.10,025/137] net: dsa: tag_8021q: fix the VLAN IDs used for encoding sub-VLANs [5.10,026/137] net: sock: fix in-kernel mark setting [5.10,027/137] net/tls: Replace TLS_RX_SYNC_RUNNING with RCU [5.10,028/137] net/tls: Fix use-after-free after the TLS device goes down and up [5.10,029/137] net/mlx5e: Fix incompatible casting [5.10,030/137] net/mlx5: Check firmware sync reset requested is set before trying to abort it [5.10,031/137] net/mlx5e: Check for needed capability for cvlan matching [5.10,032/137] net/mlx5: DR, Create multi-destination flow table with level less than 64 [5.10,033/137] nvmet: fix freeing unallocated p2pmem [5.10,034/137] netfilter: nft_ct: skip expectations for confirmed conntrack [5.10,035/137] netfilter: nfnetlink_cthelper: hit EBUSY on updates if size mismatches [5.10,036/137] drm/i915/selftests: Fix return value check in live_breadcrumbs_smoketest() [5.10,037/137] bpf: Simplify cases in bpf_base_func_proto [5.10,038/137] bpf, lockdown, audit: Fix buggy SELinux lockdown permission checks [5.10,039/137] ieee802154: fix error return code in ieee802154_add_iface() [5.10,040/137] ieee802154: fix error return code in ieee802154_llsec_getparams() [5.10,041/137] igb: add correct exception tracing for XDP [5.10,042/137] ixgbevf: add correct exception tracing for XDP [5.10,043/137] cxgb4: fix regression with HASH tc prio value update [5.10,044/137] ipv6: Fix KASAN: slab-out-of-bounds Read in fib6_nh_flush_exceptions [5.10,045/137] ice: Fix allowing VF to request more/less queues via virtchnl [5.10,046/137] ice: Fix VFR issues for AVF drivers that expect ATQLEN cleared [5.10,047/137] ice: handle the VF VSI rebuild failure [5.10,048/137] ice: report supported and advertised autoneg using PHY capabilities [5.10,049/137] ice: Allow all LLDP packets from PF to Tx [5.10,050/137] i2c: qcom-geni: Add shutdown callback for i2c [5.10,051/137] cxgb4: avoid link re-train during TC-MQPRIO configuration [5.10,052/137] i40e: optimize for XDP_REDIRECT in xsk path [5.10,053/137] i40e: add correct exception tracing for XDP [5.10,054/137] ice: simplify ice_run_xdp [5.10,055/137] ice: optimize for XDP_REDIRECT in xsk path [5.10,056/137] ice: add correct exception tracing for XDP [5.10,057/137] ixgbe: optimize for XDP_REDIRECT in xsk path [5.10,058/137] ixgbe: add correct exception tracing for XDP [5.10,059/137] arm64: dts: ti: j7200-main: Mark Main NAVSS as dma-coherent [5.10,060/137] optee: use export_uuid() to copy client UUID [5.10,061/137] bus: ti-sysc: Fix am335x resume hang for usb otg module [5.10,062/137] arm64: dts: ls1028a: fix memory node [5.10,063/137] arm64: dts: zii-ultra: fix 12V_MAIN voltage [5.10,064/137] arm64: dts: freescale: sl28: var4: fix RGMII clock and voltage [5.10,065/137] ARM: dts: imx7d-meerkat96: Fix the tuning-step property [5.10,066/137] ARM: dts: imx7d-pico: Fix the tuning-step property [5.10,067/137] ARM: dts: imx: emcon-avari: Fix nxp,pca8574 #gpio-cells [5.10,068/137] bus: ti-sysc: Fix flakey idling of uarts and stop using swsup_sidle_act [5.10,069/137] tipc: add extack messages for bearer/media failure [5.10,070/137] tipc: fix unique bearer names sanity check [5.10,071/137] serial: stm32: fix threaded interrupt handling [5.10,072/137] riscv: vdso: fix and clean-up Makefile [5.10,073/137] io_uring: fix link timeout refs [5.10,074/137] io_uring: use better types for cflags [5.10,075/137] drm/amdgpu/vcn3: add cancel_delayed_work_sync before power gate [5.10,076/137] drm/amdgpu/jpeg2.5: add cancel_delayed_work_sync before power gate [5.10,077/137] drm/amdgpu/jpeg3: add cancel_delayed_work_sync before power gate [5.10,078/137] Bluetooth: fix the erroneous flush_work() order [5.10,079/137] Bluetooth: use correct lock to prevent UAF of hdev object [5.10,080/137] wireguard: do not use -O3 [5.10,081/137] wireguard: peer: allocate in kmem_cache [5.10,082/137] wireguard: use synchronize_net rather than synchronize_rcu [5.10,083/137] wireguard: selftests: remove old conntrack kconfig value [5.10,084/137] wireguard: selftests: make sure rp_filter is disabled on vethc [5.10,085/137] wireguard: allowedips: initialize list head in selftest [5.10,086/137] wireguard: allowedips: remove nodes in O(1) [5.10,087/137] wireguard: allowedips: allocate nodes in kmem_cache [5.10,088/137] wireguard: allowedips: free empty intermediate nodes when removing single node [5.10,089/137] net: caif: added cfserl_release function [5.10,090/137] net: caif: add proper error handling [5.10,091/137] net: caif: fix memory leak in caif_device_notify [5.10,092/137] net: caif: fix memory leak in cfusbl_device_notify [5.10,093/137] HID: i2c-hid: Skip ELAN power-on command after reset [5.10,094/137] HID: magicmouse: fix NULL-deref on disconnect [5.10,095/137] HID: multitouch: require Finger field to mark Win8 reports as MT [5.10,096/137] gfs2: fix scheduling while atomic bug in glocks [5.10,097/137] ALSA: timer: Fix master timer notification [5.10,098/137] ALSA: hda: Fix for mute key LED for HP Pavilion 15-CK0xx [5.10,099/137] ALSA: hda: update the power_state during the direct-complete [5.10,100/137] ARM: dts: imx6dl-yapp4: Fix RGMII connection to QCA8334 switch [5.10,101/137] ARM: dts: imx6q-dhcom: Add PU,VDD1P1,VDD2P5 regulators [5.10,102/137] ext4: fix memory leak in ext4_fill_super [5.10,103/137] ext4: fix bug on in ext4_es_cache_extent as ext4_split_extent_at failed [5.10,104/137] ext4: fix fast commit alignment issues [5.10,105/137] ext4: fix memory leak in ext4_mb_init_backend on error path. [5.10,106/137] ext4: fix accessing uninit percpu counter variable with fast_commit [5.10,107/137] usb: dwc2: Fix build in periphal-only mode [5.10,108/137] pid: take a reference when initializing `cad_pid` [5.10,109/137] ocfs2: fix data corruption by fallocate [5.10,110/137] mm/debug_vm_pgtable: fix alignment for pmd/pud_advanced_tests() [5.10,111/137] mm/page_alloc: fix counting of free pages after take off from buddy [5.10,112/137] x86/cpufeatures: Force disable X86_FEATURE_ENQCMD and remove update_pasid() [5.10,113/137] x86/sev: Check SME/SEV support in CPUID first [5.10,114/137] nfc: fix NULL ptr dereference in llcp_sock_getname() after failed connect [5.10,115/137] drm/amdgpu: Dont query CE and UE errors [5.10,116/137] drm/amdgpu: make sure we unpin the UVD BO [5.10,117/137] x86/apic: Mark _all_ legacy interrupts when IO/APIC is missing [5.10,118/137] powerpc/kprobes: Fix validation of prefixed instructions across page boundary [5.10,119/137] btrfs: mark ordered extent and inode with error if we fail to finish [5.10,120/137] btrfs: fix error handling in btrfs_del_csums [5.10,121/137] btrfs: return errors from btrfs_del_csums in cleanup_ref_head [5.10,122/137] btrfs: fixup error handling in fixup_inode_link_counts [5.10,123/137] btrfs: abort in rename_exchange if we fail to insert the second ref [5.10,124/137] btrfs: fix deadlock when cloning inline extents and low on available space [5.10,125/137] mm, hugetlb: fix simple resv_huge_pages underflow on UFFDIO_COPY [5.10,126/137] drm/msm/dpu: always use mdp device to scale bandwidth [5.10,127/137] btrfs: fix unmountable seed device after fstrim [5.10,128/137] KVM: SVM: Truncate GPR value for DR and CR accesses in !64-bit mode [5.10,129/137] KVM: arm64: Fix debug register indexing [5.10,130/137] x86/kvm: Teardown PV features on boot CPU as well [5.10,131/137] x86/kvm: Disable kvmclock on all CPUs on shutdown [5.10,132/137] x86/kvm: Disable all PV features on crash [5.10,133/137] lib/lz4: explicitly support in-place decompression [5.10,134/137] i2c: qcom-geni: Suspend and resume the bus during SYSTEM_SLEEP_PM ops [5.10,135/137] netfilter: nf_tables: missing error reporting for not selected expressions [5.10,136/137] xen-netback: take a reference to the RX task thread [5.10,137/137] neighbour: allow NUD_NOARP entries to be forced GCed

Message ID

20210608175944.829057777@linuxfoundation.org

State

Superseded

Headers

From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org,
	syzbot+a2910119328ce8e7996f@syzkaller.appspotmail.com,
	Pavel Begunkov <asml.silence@gmail.com>,
	Jens Axboe <axboe@kernel.dk>, Sasha Levin <sashal@kernel.org>
Subject: [PATCH 5.10 073/137] io_uring: fix link timeout refs
Date: Tue,  8 Jun 2021 20:26:53 +0200
Message-Id: <20210608175944.829057777@linuxfoundation.org>
In-Reply-To: <20210608175942.377073879@linuxfoundation.org>
References: <20210608175942.377073879@linuxfoundation.org>
User-Agent: quilt/0.66
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Precedence: bulk

Series

None | expand

Commit Message

Greg KH June 8, 2021, 6:26 p.m. UTC

From: Pavel Begunkov <asml.silence@gmail.com>

[ Upstream commit a298232ee6b9a1d5d732aa497ff8be0d45b5bd82 ]

WARNING: CPU: 0 PID: 10242 at lib/refcount.c:28 refcount_warn_saturate+0x15b/0x1a0 lib/refcount.c:28
RIP: 0010:refcount_warn_saturate+0x15b/0x1a0 lib/refcount.c:28
Call Trace:
 __refcount_sub_and_test include/linux/refcount.h:283 [inline]
 __refcount_dec_and_test include/linux/refcount.h:315 [inline]
 refcount_dec_and_test include/linux/refcount.h:333 [inline]
 io_put_req fs/io_uring.c:2140 [inline]
 io_queue_linked_timeout fs/io_uring.c:6300 [inline]
 __io_queue_sqe+0xbef/0xec0 fs/io_uring.c:6354
 io_submit_sqe fs/io_uring.c:6534 [inline]
 io_submit_sqes+0x2bbd/0x7c50 fs/io_uring.c:6660
 __do_sys_io_uring_enter fs/io_uring.c:9240 [inline]
 __se_sys_io_uring_enter+0x256/0x1d60 fs/io_uring.c:9182

io_link_timeout_fn() should put only one reference of the linked timeout
request, however in case of racing with the master request's completion
first io_req_complete() puts one and then io_put_req_deferred() is
called.

Cc: stable@vger.kernel.org # 5.12+
Fixes: 9ae1f8dd372e0 ("io_uring: fix inconsistent lock state")
Reported-by: syzbot+a2910119328ce8e7996f@syzkaller.appspotmail.com
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/ff51018ff29de5ffa76f09273ef48cb24c720368.1620417627.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/io_uring.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 369ec81033d6..958c463c11eb 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -6266,6 +6266,7 @@  static enum hrtimer_restart io_link_timeout_fn(struct hrtimer *timer)
 	if (prev) {
 		io_async_find_and_cancel(ctx, req, prev->user_data, -ETIME);
 		io_put_req_deferred(prev, 1);
+		io_put_req_deferred(req, 1);
 	} else {
 		io_cqring_add_event(req, -ETIME, 0);
 		io_put_req_deferred(req, 1);

[5.10,073/137] io_uring: fix link timeout refs

Commit Message

Patch