Dylan Yudaken 80912cef18 io_uring: disallow modification of rsrc_data during quiesce
io_rsrc_ref_quiesce will unlock the uring while it waits for references to
the io_rsrc_data to be killed.
There are other places to the data that might add references to data via
calls to io_rsrc_node_switch.
There is a race condition where this reference can be added after the
completion has been signalled. At this point the io_rsrc_ref_quiesce call
will wake up and relock the uring, assuming the data is unused and can be
freed - although it is actually being used.

To fix this check in io_rsrc_ref_quiesce if a resource has been revived.

Reported-by: syzbot+ca8bf833622a1662745b@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Dylan Yudaken <dylany@fb.com>
Link: https://lore.kernel.org/r/20220222161751.995746-1-dylany@fb.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2022-02-22 09:57:32 -07:00
..
2022-01-22 08:33:37 +02:00
2021-08-19 09:02:55 +09:00
2022-01-22 08:33:38 +02:00
2022-01-22 10:59:32 +02:00
2022-01-19 23:14:34 -06:00
2021-11-09 10:02:51 -08:00
2021-10-25 19:11:50 -07:00
2022-01-12 11:11:34 -08:00
2021-12-03 18:44:06 +01:00
2022-01-12 15:46:11 -08:00
2022-01-22 08:33:38 +02:00
2022-01-23 06:20:44 +02:00
2022-01-12 11:11:34 -08:00
2022-01-12 15:46:11 -08:00
2022-01-22 08:33:37 +02:00
2021-11-03 09:23:25 -07:00
2022-01-20 13:39:13 +02:00
2022-01-22 08:33:38 +02:00
2022-01-23 06:20:44 +02:00
2022-01-22 08:33:37 +02:00
2022-01-10 11:48:37 -08:00
\n
2021-11-06 16:40:48 -07:00
2022-01-16 10:15:32 +02:00
2021-08-19 09:02:55 +09:00
2022-01-22 11:04:27 +02:00
2021-12-17 16:56:35 +09:00
2022-01-22 08:33:34 +02:00
2021-11-17 09:26:09 +01:00
2022-01-12 13:45:12 -08:00
2022-01-22 08:33:35 +02:00
2022-01-21 16:07:21 +02:00
2022-01-07 13:40:39 +00:00
2022-01-22 08:33:38 +02:00
2022-01-22 08:33:36 +02:00
2022-01-22 08:33:36 +02:00
2022-01-22 08:33:38 +02:00
2021-08-10 17:57:22 +02:00