io_uring: fix fs->users overflow
There is a bunch of cases where we can grab req->fs but not put it, this
can be used to cause a controllable overflow with further implications.
Release req->fs in the request free path and make sure we zero the field
to be sure we don't do it twice.
Fixes: cac68d12c531 ("io_uring: grab ->fs as part of async offload")
Reported-by: Bing-Jhong Billy Jheng <billy@starlabs.sg>
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 1a623d361ffe5cecd4244a02f449528416360038)
Signed-off-by: Robert Kolchmeyer <rkolchmeyer@google.com>
BUG=b/230125935
TEST=presubmit
RELEASE_NOTE=Fixed CVE-2022-1116 in the Linux kernel.
cos-patch: security-high
Change-Id: I3011d7291dbb2d797c09c269c029b50429f76b93
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/32086
Reviewed-by: Roy Yang <royyang@google.com>
Reviewed-by: Oleksandr Tymoshenko <ovt@google.com>
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
diff --git a/fs/io_uring.c b/fs/io_uring.c
index 478df7e..e73969f 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -438,6 +438,22 @@
return ctx;
}
+static void io_req_put_fs(struct io_kiocb *req)
+{
+ struct fs_struct *fs = req->fs;
+
+ if (!fs)
+ return;
+
+ spin_lock(&req->fs->lock);
+ if (--fs->users)
+ fs = NULL;
+ spin_unlock(&req->fs->lock);
+ if (fs)
+ free_fs_struct(fs);
+ req->fs = NULL;
+}
+
static inline bool __io_sequence_defer(struct io_ring_ctx *ctx,
struct io_kiocb *req)
{
@@ -695,6 +711,7 @@
static void __io_free_req(struct io_kiocb *req)
{
+ io_req_put_fs(req);
if (req->file && !(req->flags & REQ_F_FIXED_FILE))
fput(req->file);
percpu_ref_put(&req->ctx->refs);
@@ -1701,16 +1718,7 @@
ret = -EINTR;
}
- if (req->fs) {
- struct fs_struct *fs = req->fs;
-
- spin_lock(&req->fs->lock);
- if (--fs->users)
- fs = NULL;
- spin_unlock(&req->fs->lock);
- if (fs)
- free_fs_struct(fs);
- }
+ io_req_put_fs(req);
io_cqring_add_event(req->ctx, sqe->user_data, ret);
io_put_req(req);
return 0;
