tree c4d698200a70b31bb0e0a27c99534f70284f76a0
parent 6f40735398fd5b7eff8486c0356cdcb4c49b0272
author Pavel Begunkov <asml.silence@gmail.com> 1665961391 +0100
committer COS Cherry Picker <cloud-image-release@prod.google.com> 1666371849 -0700

io_uring/af_unix: defer registered files gc to io_uring release

[ upstream commit 0091bfc81741b8d3aeb3b7ab8636f911b2de6e80 ]

Instead of putting io_uring's registered files in unix_gc() we want it
to be done by io_uring itself. The trick here is to consider io_uring
registered files for cycle detection but not actually putting them down.
Because io_uring can't register other ring instances, this will remove
all refs to the ring file triggering the ->release path and clean up
with io_ring_ctx_free().

Cc: stable@vger.kernel.org
Fixes: 6b06314c47e1 ("io_uring: add file set registration")
Reported-and-tested-by: David Bouman <dbouman03@gmail.com>
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
[axboe: add kerneldoc comment to skb, fold in skb leak fix]
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

BUG=b/254721300
TEST=presubmit
RELEASE_NOTE=Fixed CVE-2022-2602 in the Linux kernel.

cos-patch: security-high
Change-Id: I627aa666fe0f4686202b8a4f4bfec26e131c3134
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/37851
Reviewed-by: Oleksandr Tymoshenko <ovt@google.com>
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
Main-Branch-Verified: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>