io_uring: fix leaking reg files on exit

If io_sqe_files_unregister() faults on io_rsrc_ref_quiesce(), it will
fail to do unregister leaving files referenced. And that may well happen
because of a strayed signal or just because it does allocations inside.

In io_ring_ctx_free() do an unsafe version of unregister, as it's
guaranteed to not have requests by that point and so quiesce is useless.

Cc: stable@vger.kernel.org
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/e696e9eade571b51997d0dc1d01f144c6d685c05.1618278933.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 8564c7908126268d239eff050baa185448ca0655..1af8bb5f7d56fa2543cae47af8d1d988552d02bf 100644 (file)
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -7089,6 +7089,10 @@ static void __io_sqe_files_unregister(struct io_ring_ctx *ctx)
                        fput(file);
        }
 #endif
+       io_free_file_tables(&ctx->file_table, ctx->nr_user_files);
+       kfree(ctx->file_data);
+       ctx->file_data = NULL;
+       ctx->nr_user_files = 0;
 }
 
 static inline void io_rsrc_ref_lock(struct io_ring_ctx *ctx)
@@ -7195,21 +7199,14 @@ static struct io_rsrc_data *io_rsrc_data_alloc(struct io_ring_ctx *ctx,
 
 static int io_sqe_files_unregister(struct io_ring_ctx *ctx)
 {
-       struct io_rsrc_data *data = ctx->file_data;
        int ret;
 
-       if (!data)
+       if (!ctx->file_data)
                return -ENXIO;
-       ret = io_rsrc_ref_quiesce(data, ctx);
-       if (ret)
-               return ret;
-
-       __io_sqe_files_unregister(ctx);
-       io_free_file_tables(&ctx->file_table, ctx->nr_user_files);
-       kfree(data);
-       ctx->file_data = NULL;
-       ctx->nr_user_files = 0;
-       return 0;
+       ret = io_rsrc_ref_quiesce(ctx->file_data, ctx);
+       if (!ret)
+               __io_sqe_files_unregister(ctx);
+       return ret;
 }
 
 static void io_sq_thread_unpark(struct io_sq_data *sqd)
@@ -7659,7 +7656,7 @@ static int io_sqe_files_register(struct io_ring_ctx *ctx, void __user *arg,
 
        ret = io_sqe_files_scm(ctx);
        if (ret) {
-               io_sqe_files_unregister(ctx);
+               __io_sqe_files_unregister(ctx);
                return ret;
        }
 
@@ -8460,7 +8457,11 @@ static void io_ring_ctx_free(struct io_ring_ctx *ctx)
        }
 
        mutex_lock(&ctx->uring_lock);
-       io_sqe_files_unregister(ctx);
+       if (ctx->file_data) {
+               if (!atomic_dec_and_test(&ctx->file_data->refs))
+                       wait_for_completion(&ctx->file_data->done);
+               __io_sqe_files_unregister(ctx);
+       }
        if (ctx->rings)
                __io_cqring_overflow_flush(ctx, true);
        mutex_unlock(&ctx->uring_lock);