Jann Horn and Greg Kroah-Hartman
06eb089489
io_uring: Fix registered ring file refcount leak
...
commit 12d908116f upstream.
Currently, io_uring_unreg_ringfd() (which cleans up registered rings) is
only called on exit, but __io_uring_free (which frees the tctx in which the
registered ring pointers are stored) is also called on execve (via
begin_new_exec -> io_uring_task_cancel -> __io_uring_cancel ->
io_uring_cancel_generic -> __io_uring_free).
This means: A process going through execve while having registered rings
will leak references to the rings' `struct file`.
Fix it by zapping registered rings on execve(). This is implemented by
moving the io_uring_unreg_ringfd() from io_uring_files_cancel() into its
callee __io_uring_cancel(), which is called from io_uring_task_cancel() on
execve.
This could probably be exploited *on 32-bit kernels* by leaking 2^32
references to the same ring, because the file refcount is stored in a
pointer-sized field and get_file() doesn't have protection against
refcount overflow, just a WARN_ONCE(); but on 64-bit it should have no
impact beyond a memory leak.
Cc: stable@vger.kernel.org
Fixes: e7a6c00dc7 ("io_uring: add support for registering ring file descriptors")
Signed-off-by: Jann Horn <jannh@google.com >
Link: https://lore.kernel.org/r/20241218-uring-reg-ring-cleanup-v1-1-8f63e999045b@google.com
Signed-off-by: Jens Axboe <axboe@kernel.dk >
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org >
2024-12-27 14:02:17 +01:00
..
2024-10-02 17:23:23 -04:00
2024-09-25 11:01:27 +02:00
2024-12-19 18:13:14 +01:00
2024-10-11 15:59:15 -07:00
2024-12-14 20:03:12 +01:00
2024-12-14 20:03:26 +01:00
2024-10-08 17:44:27 +02:00
2024-09-23 14:17:08 -07:00
2024-10-02 17:14:53 -07:00
2024-12-14 20:03:40 +01:00
2024-10-02 17:23:23 -04:00
2024-09-26 12:00:25 -07:00
2024-12-05 14:01:23 +01:00
2024-11-04 14:23:09 +01:00
2024-10-15 07:54:16 +02:00
2024-10-02 17:23:23 -04:00
2024-12-14 20:04:07 +01:00
2024-09-27 09:55:30 -07:00
2024-12-27 14:02:13 +01:00
2024-11-06 21:31:36 +01:00
2024-12-27 14:01:57 +01:00
2024-11-07 11:18:52 +00:00
2024-09-13 15:41:42 +02:00
2024-10-16 13:17:45 +02:00
2024-09-27 12:10:45 -07:00
2024-09-25 14:56:40 -07:00
2024-09-13 13:22:09 -06:00
2024-12-05 14:03:05 +01:00
2024-12-19 18:13:00 +01:00
2024-10-30 12:13:46 -07:00
2024-10-24 10:17:12 -07:00
2024-12-19 18:13:09 +01:00
2024-09-16 08:54:30 +02:00
2024-09-11 09:58:30 -07:00
2024-09-21 07:29:05 -07:00
2024-09-21 09:44:57 -07:00
2024-12-14 20:03:38 +01:00
2024-12-14 20:04:16 +01:00
2024-10-09 16:57:57 -04:00
2024-12-05 14:02:45 +01:00
2024-12-05 14:02:45 +01:00
2024-10-23 16:04:30 +01:00
2024-12-19 18:13:23 +01:00
2024-09-18 07:52:24 +02:00
2024-09-26 11:39:02 -07:00
2024-10-01 20:43:44 +02:00
2024-09-18 15:03:58 +02:00
2024-09-27 12:10:45 -07:00
2024-09-27 08:18:43 -07:00
2024-10-25 16:07:03 -05:00
2024-09-22 18:47:51 +02:00
2024-12-14 20:04:09 +01:00
2024-10-02 17:23:23 -04:00
2024-12-14 20:03:35 +01:00
2024-12-14 20:03:12 +01:00
2024-12-14 20:03:48 +01:00
2024-09-19 10:18:15 +02:00
2024-09-29 21:52:29 -04:00
2024-09-23 09:35:36 -07:00
2024-09-21 09:27:50 -07:00
2024-09-12 22:30:37 +09:00
2024-10-01 17:01:40 +02:00
2024-10-21 14:30:26 +02:00
2024-12-05 14:01:11 +01:00
2024-10-02 15:14:29 +02:00
2024-09-24 16:10:12 +02:00
2024-12-14 20:03:39 +01:00
2024-12-05 14:01:18 +01:00
2024-10-15 18:46:25 +02:00
2024-10-17 00:28:10 -07:00
2024-09-26 14:01:43 -07:00
2024-09-13 07:27:36 -07:00
2024-12-27 14:02:15 +01:00
2024-09-21 12:46:00 +02:00
2024-10-02 17:23:23 -04:00
2024-11-02 22:28:58 -07:00
2024-12-05 14:01:35 +01:00
2024-12-27 14:02:17 +01:00
2024-11-01 07:45:00 -10:00
2024-09-22 18:48:00 +02:00
2024-09-12 12:20:42 +02:00
2024-12-05 14:01:22 +01:00
2024-12-09 10:41:08 +01:00
2024-09-20 18:28:26 +03:00
2024-12-05 14:03:03 +01:00
2024-09-25 20:12:58 +09:00
2024-10-28 21:40:39 -07:00
2024-12-05 14:02:43 +01:00
2024-12-14 20:04:01 +01:00
2024-12-05 14:02:46 +01:00
2024-09-24 14:54:26 -07:00
2024-11-11 00:00:37 -08:00
2024-10-21 22:11:19 +08:00
2024-11-05 16:49:55 -08:00
2024-12-05 14:03:08 +01:00
2024-11-07 14:14:58 -08:00
2024-09-23 11:07:55 +02:00
2024-09-13 07:36:02 +02:00
2024-12-19 18:13:19 +01:00
2024-10-21 12:54:25 +02:00
2024-09-26 13:03:03 +02:00
2024-09-12 12:20:41 +02:00
2024-12-05 14:02:01 +01:00
2024-09-20 19:31:03 -04:00
2024-09-23 15:03:29 -04:00
2024-10-03 16:19:13 -04:00
2024-09-23 15:03:29 -04:00
2024-09-23 15:03:30 -04:00
2024-12-05 14:02:27 +01:00
2024-09-11 20:53:45 -07:00
2024-12-05 14:01:32 +01:00
2024-12-05 14:03:08 +01:00
2024-12-05 14:03:08 +01:00
2024-12-14 20:03:33 +01:00
2024-09-20 17:53:17 -07:00
2024-09-23 14:08:08 -07:00
2024-09-19 14:25:32 -05:00
2024-12-14 20:04:04 +01:00
2024-10-17 00:28:07 -07:00
2024-09-18 15:03:58 +02:00
2024-09-17 01:06:59 -07:00
2024-10-30 17:11:28 +01:00
2024-10-02 17:23:23 -04:00
2024-12-05 14:03:07 +01:00
2024-09-18 08:53:53 +02:00
2024-09-18 08:53:53 +02:00
2024-12-05 14:01:23 +01:00
2024-09-20 00:20:06 -06:00
2024-12-14 20:03:18 +01:00
2024-12-27 14:01:59 +01:00
2024-10-09 12:47:18 -07:00
2024-12-05 14:01:23 +01:00
2024-09-11 15:47:13 +02:00
2024-09-17 01:07:00 -07:00
2024-09-11 20:44:31 -07:00
2024-09-11 20:44:31 -07:00
2024-09-21 07:29:05 -07:00
2024-09-18 07:52:24 +02:00
2024-09-11 20:44:32 -07:00
2024-11-13 19:29:46 -08:00
2024-12-05 14:01:23 +01:00
2024-12-14 20:03:32 +01:00
2024-12-19 18:13:24 +01:00
2024-09-19 10:18:15 +02:00
2024-10-30 20:14:11 -07:00
2024-10-11 10:49:32 +02:00
2024-10-27 10:36:04 +01:00
2024-12-14 20:04:16 +01:00
2024-11-13 21:10:45 +02:00
2024-12-27 14:02:16 +01:00
2024-09-25 23:23:44 +09:00
2024-10-30 11:38:10 -10:00
2024-09-12 12:20:39 +02:00
2024-10-02 17:23:23 -04:00
2024-09-17 01:07:01 -07:00
2024-11-07 14:14:59 -08:00
2024-10-28 21:40:38 -07:00
2024-12-09 10:41:06 +01:00
2024-10-02 17:21:59 -07:00
2024-12-19 18:12:59 +01:00
2024-11-11 00:00:37 -08:00
2024-09-21 07:29:05 -07:00