The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to stable@vger.kernel.org.
Possible dependencies:
c0737fa9a5a5 ("io_uring: fix double poll leak on repolling") 10c873334feb ("io_uring: allow re-poll if we made progress") 52dd86406dfa ("io_uring: enable EPOLLEXCLUSIVE for accept poll") 4d9237e32c5d ("io_uring: recycle apoll_poll entries") cc3cec8367cb ("io_uring: speedup provided buffer handling") d5ec1dfaf59b ("io-uring: add __fill_cqe function") 77bc59b49817 ("io_uring: avoid ring quiesce while registering/unregistering eventfd") 0d7c1153d929 ("io_uring: Clean up a false-positive warning from GCC 9.3.0") 42a7b4ed45e7 ("Merge tag 'for-5.17/io_uring-2022-01-11' of git://git.kernel.dk/linux-block")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From c0737fa9a5a5cf5a053bcc983f72d58919b997c6 Mon Sep 17 00:00:00 2001 From: Pavel Begunkov asml.silence@gmail.com Date: Wed, 22 Jun 2022 00:00:37 +0100 Subject: [PATCH] io_uring: fix double poll leak on repolling
We have re-polling for partial IO, so a request can be polled twice. If it used two poll entries the first time then on the second io_arm_poll_handler() it will find the old apoll entry and NULL kmalloc()'ed second entry, i.e. apoll->double_poll, so leaking it.
Fixes: 10c873334feba ("io_uring: allow re-poll if we made progress") Signed-off-by: Pavel Begunkov asml.silence@gmail.com Link: https://lore.kernel.org/r/fee2452494222ecc7f1f88c8fb659baef971414a.165585224... Signed-off-by: Jens Axboe axboe@kernel.dk
diff --git a/fs/io_uring.c b/fs/io_uring.c index cb719a53b8bd..5c95755619e2 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -7208,6 +7208,7 @@ static int io_arm_poll_handler(struct io_kiocb *req, unsigned issue_flags) mask |= EPOLLEXCLUSIVE; if (req->flags & REQ_F_POLLED) { apoll = req->apoll; + kfree(apoll->double_poll); } else if (!(issue_flags & IO_URING_F_UNLOCKED) && !list_empty(&ctx->apoll_cache)) { apoll = list_first_entry(&ctx->apoll_cache, struct async_poll,