mirror of
https://github.com/torvalds/linux.git
synced 2026-10-23 23:51:02 +02:00
a3bdf68fee
Submitting SQEs through an io_uring BPF loop can trigger a NULL pointer
dereference in io_submit_sqes(), as shown by the following arm64 report:
[ 2049.380301] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
[ 2049.388788] pc : io_submit_sqes+0x48/0x6c4
[ 2049.389153] lr : bpf_io_uring_submit_sqes+0x10/0x1c
[ 2049.396310] Call trace:
[ 2049.396531] io_submit_sqes+0x48/0x6c4 (P)
[ 2049.396893] bpf_io_uring_submit_sqes+0x10/0x1c
[ 2049.397293] bpf_prog_1a2a95cb199202b5+0x3c/0x68
[ 2049.397699] bpf__io_uring_bpf_ops_loop_step+0x5c/0x94
[ 2049.398149] io_run_loop+0x70/0x2e4
[ 2049.398461] __arm64_sys_io_uring_enter+0xf0/0x710
[ 2049.398882] invoke_syscall+0x54/0x10c
[ 2049.399414] el0_svc_common.constprop.0+0x40/0xe0
[ 2049.399829] do_el0_svc+0x1c/0x28
[ 2049.400125] el0_svc+0x38/0x1d0
[ 2049.400409] el0t_64_sync_handler+0xa0/0xe4
[ 2049.400779] el0t_64_sync+0x198/0x19c
io_uring_enter() dispatches to io_run_loop() before reaching the normal
submission path's io_uring_add_tctx_node() call. The loop only checks
whether the caller is allowed to run task work; it does not initialize
current->io_uring or associate the task with the ring. A BPF call to
bpf_io_uring_submit_sqes() then reaches io_get_task_refs(), which assumes
that current->io_uring is valid.
A ring created with IORING_SETUP_R_DISABLED, IORING_SETUP_SINGLE_ISSUER
and IORING_SETUP_DEFER_TASKRUN can be enabled by a different task that
has never used io_uring. Enabling the ring makes that task the submitter
without allocating its io_uring task context. Its first BPF-driven
submission of a pending SQE can therefore cause a kernel Oops.
Call io_uring_add_tctx_node() in io_run_loop() before invoking the loop
and propagate any initialization error. Do this before acquiring
uring_lock, since task context setup may acquire the same mutex. This
also establishes the task-to-ring association used for cancellation.
Fixes: 033af2b3eb ("io_uring: introduce callback driven main loop")
Signed-off-by: Yao Kai <yaokai34@huawei.com>
Link: https://patch.msgid.link/20260923014310.591292-1-yaokai34@huawei.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
97 lines
2.1 KiB
C
97 lines
2.1 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
#include "io_uring.h"
|
|
#include "wait.h"
|
|
#include "loop.h"
|
|
#include "tctx.h"
|
|
|
|
static inline int io_loop_nr_cqes(const struct io_ring_ctx *ctx,
|
|
const struct iou_loop_params *lp)
|
|
{
|
|
return lp->cq_wait_idx - READ_ONCE(ctx->rings->cq.tail);
|
|
}
|
|
|
|
static inline void io_loop_wait_start(struct io_ring_ctx *ctx, unsigned nr_wait)
|
|
{
|
|
atomic_set(&ctx->cq_wait_nr, nr_wait);
|
|
set_current_state(TASK_INTERRUPTIBLE);
|
|
}
|
|
|
|
static inline void io_loop_wait_finish(struct io_ring_ctx *ctx)
|
|
{
|
|
__set_current_state(TASK_RUNNING);
|
|
atomic_set(&ctx->cq_wait_nr, IO_CQ_WAKE_INIT);
|
|
}
|
|
|
|
static void io_loop_wait(struct io_ring_ctx *ctx, struct iou_loop_params *lp,
|
|
unsigned nr_wait)
|
|
{
|
|
io_loop_wait_start(ctx, nr_wait);
|
|
|
|
if (unlikely(io_local_work_pending(ctx) ||
|
|
io_loop_nr_cqes(ctx, lp) <= 0) ||
|
|
READ_ONCE(ctx->check_cq)) {
|
|
io_loop_wait_finish(ctx);
|
|
return;
|
|
}
|
|
|
|
mutex_unlock(&ctx->uring_lock);
|
|
schedule();
|
|
io_loop_wait_finish(ctx);
|
|
mutex_lock(&ctx->uring_lock);
|
|
}
|
|
|
|
static int __io_run_loop(struct io_ring_ctx *ctx)
|
|
{
|
|
struct iou_loop_params lp = {};
|
|
|
|
while (true) {
|
|
int nr_wait, step_res;
|
|
|
|
if (unlikely(!ctx->loop_step))
|
|
return -EFAULT;
|
|
|
|
step_res = ctx->loop_step(io_loop_mangle_ctx(ctx), &lp);
|
|
if (step_res == IOU_LOOP_STOP)
|
|
break;
|
|
if (step_res != IOU_LOOP_CONTINUE)
|
|
return -EINVAL;
|
|
|
|
nr_wait = io_loop_nr_cqes(ctx, &lp);
|
|
if (nr_wait > 0)
|
|
io_loop_wait(ctx, &lp, nr_wait);
|
|
else
|
|
nr_wait = 0;
|
|
|
|
if (task_work_pending(current)) {
|
|
mutex_unlock(&ctx->uring_lock);
|
|
io_run_task_work();
|
|
mutex_lock(&ctx->uring_lock);
|
|
}
|
|
if (unlikely(task_sigpending(current)))
|
|
return -EINTR;
|
|
io_run_local_work_locked(ctx, nr_wait);
|
|
|
|
if (READ_ONCE(ctx->check_cq) & BIT(IO_CHECK_CQ_OVERFLOW_BIT))
|
|
io_cqring_overflow_flush_locked(ctx);
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
int io_run_loop(struct io_ring_ctx *ctx)
|
|
{
|
|
int ret;
|
|
|
|
ret = io_uring_add_tctx_node(ctx);
|
|
if (unlikely(ret))
|
|
return ret;
|
|
|
|
if (!io_allowed_run_tw(ctx))
|
|
return -EEXIST;
|
|
|
|
mutex_lock(&ctx->uring_lock);
|
|
ret = __io_run_loop(ctx);
|
|
mutex_unlock(&ctx->uring_lock);
|
|
return ret;
|
|
}
|