Jann Horn 12d908116f io_uring: Fix registered ring file refcount leak ... Currently, io_uring_unreg_ringfd() (which cleans up registered rings) is only called on exit, but __io_uring_free (which frees the tctx in which the registered ring pointers are stored) is also called on execve (via begin_new_exec -> io_uring_task_cancel -> __io_uring_cancel -> io_uring_cancel_generic -> __io_uring_free). This means: A process going through execve while having registered rings will leak references to the rings' `struct file`. Fix it by zapping registered rings on execve(). This is implemented by moving the io_uring_unreg_ringfd() from io_uring_files_cancel() into its callee __io_uring_cancel(), which is called from io_uring_task_cancel() on execve. This could probably be exploited *on 32-bit kernels* by leaking 2^32 references to the same ring, because the file refcount is stored in a pointer-sized field and get_file() doesn't have protection against refcount overflow, just a WARN_ONCE(); but on 64-bit it should have no impact beyond a memory leak. Cc: stable@vger.kernel.org Fixes: e7a6c00dc7 ("io_uring: add support for registering ring file descriptors") Signed-off-by: Jann Horn <jannh@google.com> Link: https://lore.kernel.org/r/20241218-uring-reg-ring-cleanup-v1-1-8f63e999045b@google.com Signed-off-by: Jens Axboe <axboe@kernel.dk>		2024-12-18 18:19:33 -07:00
..
advise.c	io_uring/advise: support 64-bit lengths	2024-06-16 14:54:55 -06:00
advise.h	io_uring: split out fadvise/madvise operations	2022-07-24 18:39:11 -06:00
alloc_cache.h	io_uring/alloc_cache: switch to array based caching	2024-04-15 08:10:25 -06:00
cancel.c	io_uring: move struct io_kiocb from task_struct to io_uring_task	2024-11-06 13:55:38 -07:00
cancel.h	io_uring/cancel: get rid of init_hash_table() helper	2024-10-29 13:43:27 -06:00
epoll.c	io_uring: undeprecate epoll_ctl support	2023-05-26 20:22:41 -06:00
epoll.h	io_uring: move epoll handler to its own file	2022-07-24 18:39:11 -06:00
eventfd.c	io_uring/eventfd: move ctx->evfd_last_cq_tail into io_ev_fd	2024-10-29 13:43:26 -06:00
eventfd.h	io_uring/eventfd: move eventfd handling to separate file	2024-06-16 14:54:55 -06:00
fdinfo.c	io_uring/napi: add static napi tracking strategy	2024-11-06 13:55:38 -07:00
fdinfo.h	io_uring: move fdinfo helpers to its own file	2022-07-24 18:39:12 -06:00
filetable.c	io_uring/rsrc: pass 'struct io_ring_ctx' reference to rsrc helpers	2024-11-07 15:24:33 -07:00
filetable.h	io_uring/rsrc: pass 'struct io_ring_ctx' reference to rsrc helpers	2024-11-07 15:24:33 -07:00
fs.c	io_uring/fs: consider link->flags when getting path for LINKAT	2023-11-20 09:01:42 -07:00
fs.h	io_uring: split out filesystem related operations	2022-07-24 18:39:11 -06:00
futex.c	io_uring: move cancelations to be io_uring_task based	2024-11-06 13:55:38 -07:00
futex.h	io_uring: move cancelations to be io_uring_task based	2024-11-06 13:55:38 -07:00
io_uring.c	io_uring: Fix registered ring file refcount leak	2024-12-18 18:19:33 -07:00
io_uring.h	io_uring: limit local tw done	2024-11-21 07:11:00 -07:00
io-wq.c	io_uring/io-wq: inherit cpuset of cgroup in io worker	2024-09-11 07:27:56 -06:00
io-wq.h	io_uring/io-wq: make io_wq_work flags atomic	2024-06-16 14:54:55 -06:00
kbuf.c	for-6.12/io_uring-20240913	2024-09-16 13:29:00 +02:00
kbuf.h	io_uring/kbuf: add support for incremental buffer consumption	2024-08-29 08:44:58 -06:00
Makefile	io_uring: add GCOV_PROFILE_URING Kconfig option	2024-08-30 10:52:02 -06:00
memmap.c	io_uring: fix corner case forgetting to vunmap	2024-11-27 15:00:57 -07:00
memmap.h	io_uring: introduce concept of memory regions	2024-11-15 09:58:34 -07:00
msg_ring.c	switch io_msg_ring() to CLASS(fd)	2024-11-15 09:55:54 -07:00
msg_ring.h	io_uring/msg_ring: add support for sending a sync message	2024-10-29 13:43:26 -06:00
napi.c	io_uring/napi: add static napi tracking strategy	2024-11-06 13:55:38 -07:00
napi.h	io_uring/napi: add static napi tracking strategy	2024-11-06 13:55:38 -07:00
net.c	io_uring/rsrc: add & apply io_req_assign_buf_node()	2024-11-07 15:24:33 -07:00
net.h	io_uring: Introduce IORING_OP_LISTEN	2024-06-19 07:57:21 -06:00
nop.c	io_uring/nop: ensure nop->fd is always initialized	2024-11-21 07:15:30 -07:00
nop.h	io_uring: move nop into its own file	2022-07-24 18:39:11 -06:00
notif.c	io_uring: move struct io_kiocb from task_struct to io_uring_task	2024-11-06 13:55:38 -07:00
notif.h	io_uring/notif: implement notification stacking	2024-04-22 19:31:18 -06:00
opdef.c	io_uring/splice: open code 2nd direct file assignment	2024-10-29 13:43:28 -06:00
opdef.h	io_uring: Fix probe of disabled operations	2024-06-19 08:58:00 -06:00
openclose.c	io_uring: enable audit and restrict cred override for IORING_OP_FIXED_FD_INSTALL	2024-01-23 15:25:14 -07:00
openclose.h	io_uring/openclose: add support for IORING_OP_FIXED_FD_INSTALL	2023-12-12 07:42:57 -07:00
poll.c	io_uring: move struct io_kiocb from task_struct to io_uring_task	2024-11-06 13:55:38 -07:00
poll.h	io_uring: move cancelations to be io_uring_task based	2024-11-06 13:55:38 -07:00
refs.h	io_uring: kill dead code in io_req_complete_post	2024-04-15 08:10:26 -06:00
register.c	io_uring: protect register tracing	2024-11-18 09:10:56 -07:00
register.h	io_uring: temporarily disable registered waits	2024-11-15 09:58:34 -07:00
rsrc.c	io_uring/rsrc: don't put/free empty buffers	2024-12-12 08:01:52 -07:00
rsrc.h	io_uring/rsrc: add & apply io_req_assign_buf_node()	2024-11-07 15:24:33 -07:00
rw.c	A rather large update for timekeeping and timers:	2024-11-19 16:35:06 -08:00
rw.h	io_uring/alloc_cache: switch to array based caching	2024-04-15 08:10:25 -06:00
slist.h	io_uring: silence variable ‘prev’ set but not used warning	2023-03-09 10:10:58 -07:00
splice.c	io_uring/rsrc: pass 'struct io_ring_ctx' reference to rsrc helpers	2024-11-07 15:24:33 -07:00
splice.h	io_uring/splice: open code 2nd direct file assignment	2024-10-29 13:43:28 -06:00
sqpoll.c	for-6.13/io_uring-20241118	2024-11-18 17:02:57 -08:00
sqpoll.h	io_uring/sqpoll: statistics of the true utilization of sq threads	2024-03-01 06:28:19 -07:00
statx.c	io_statx_prep(): use getname_uflags()	2024-11-13 11:44:30 -05:00
statx.h	io_uring: move statx handling to its own file	2022-07-24 18:39:11 -06:00
sync.c	io_uring: for requests that require async, force it	2023-01-29 15:18:26 -07:00
sync.h	io_uring: split out fs related sync/fallocate functions	2022-07-24 18:39:11 -06:00
tctx.c	io_uring/tctx: work around xa_store() allocation error issue	2024-11-29 07:20:28 -07:00
tctx.h	io_uring: simplify __io_uring_add_tctx_node	2022-10-07 12:25:30 -06:00
timeout.c	io_uring: make ctx->timeout_lock a raw spinlock	2024-12-17 08:21:46 -07:00
timeout.h	io_uring: move cancelations to be io_uring_task based	2024-11-06 13:55:38 -07:00
truncate.c	io_uring: add support for ftruncate	2024-02-09 09:04:39 -07:00
truncate.h	io_uring: add support for ftruncate	2024-02-09 09:04:39 -07:00
uring_cmd.c	io_uring: Change res2 parameter type in io_uring_cmd_done	2024-12-03 06:33:13 -07:00
uring_cmd.h	io_uring: move cancelations to be io_uring_task based	2024-11-06 13:55:38 -07:00
waitid.c	io_uring: move struct io_kiocb from task_struct to io_uring_task	2024-11-06 13:55:38 -07:00
waitid.h	io_uring: move cancelations to be io_uring_task based	2024-11-06 13:55:38 -07:00
xattr.c	replace do_getxattr() with saner helpers.	2024-11-06 12:59:39 -05:00
xattr.h	io_uring: move xattr related opcodes to its own file	2022-07-24 18:39:11 -06:00