Commit b19062a5 authored Apr 15, 2019 by Jens Axboe

io_uring: fix possible deadlock between io_uring_{enter,register}



If we have multiple threads, one doing io_uring_enter() while the other
is doing io_uring_register(), we can run into a deadlock between the
two. io_uring_register() must wait for existing users of the io_uring
instance to exit. But it does so while holding the io_uring mutex.
Callers of io_uring_enter() may need this mutex to make progress (and
eventually exit). If we wait for users to exit in io_uring_register(),
we can't do so with the io_uring mutex held without potentially risking
a deadlock.

Drop the io_uring mutex while waiting for existing callers to exit. This
is safe and guaranteed to make forward progress, since we already killed
the percpu ref before doing so. Hence later callers of io_uring_enter()
will be rejected.

Reported-by:  <syzbot+16dc03452dee970a0c3e@syzkaller.appspotmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

parent 3d6770fb

fs/io_uring.c

+12 −0

Original line number	Diff line number	Diff line
		@@ -2929,11 +2929,23 @@ SYSCALL_DEFINE2(io_uring_setup, u32, entries,

		static int __io_uring_register(struct io_ring_ctx *ctx, unsigned opcode,
		void __user *arg, unsigned nr_args)
		__releases(ctx->uring_lock)
		__acquires(ctx->uring_lock)
		{
		int ret;

		percpu_ref_kill(&ctx->refs);

		/*
		* Drop uring mutex before waiting for references to exit. If another
		* thread is currently inside io_uring_enter() it might need to grab
		* the uring_lock to make progress. If we hold it here across the drain
		* wait, then we can deadlock. It's safe to drop the mutex here, since
		* no new references will come in after we've killed the percpu ref.
		*/
		mutex_unlock(&ctx->uring_lock);
		wait_for_completion(&ctx->ctx_done);
		mutex_lock(&ctx->uring_lock);

		switch (opcode) {
		case IORING_REGISTER_BUFFERS:

Admin message