io_uring: use bottom half safe lock for fixed file data

io_file_data_ref_zero() can be invoked from soft-irq from the RCU core,
hence we need to ensure that the file_data lock is bottom half safe. Use
the _bh() variants when grabbing this lock.

Reported-by: syzbot+1f4ba1e5520762c523c6@syzkaller.appspotmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 91536947ef08b93861356f1bd5ff9db34462816a..e66888d45778f1341ff4d14cee2fc9e6dd8697e3 100644 (file)
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -7185,9 +7185,9 @@ static int io_sqe_files_unregister(struct io_ring_ctx *ctx)
        if (!data)
                return -ENXIO;
 
-       spin_lock(&data->lock);
+       spin_lock_bh(&data->lock);
        ref_node = data->node;
-       spin_unlock(&data->lock);
+       spin_unlock_bh(&data->lock);
        if (ref_node)
                percpu_ref_kill(&ref_node->refs);
 
@@ -7569,7 +7569,7 @@ static void io_file_data_ref_zero(struct percpu_ref *ref)
        data = ref_node->file_data;
        ctx = data->ctx;
 
-       spin_lock(&data->lock);
+       spin_lock_bh(&data->lock);
        ref_node->done = true;
 
        while (!list_empty(&data->ref_list)) {
@@ -7581,7 +7581,7 @@ static void io_file_data_ref_zero(struct percpu_ref *ref)
                list_del(&ref_node->node);
                first_add |= llist_add(&ref_node->llist, &ctx->file_put_llist);
        }
-       spin_unlock(&data->lock);
+       spin_unlock_bh(&data->lock);
 
        if (percpu_ref_is_dying(&data->refs))
                delay = 0;
@@ -7704,9 +7704,9 @@ static int io_sqe_files_register(struct io_ring_ctx *ctx, void __user *arg,
        }
 
        file_data->node = ref_node;
-       spin_lock(&file_data->lock);
+       spin_lock_bh(&file_data->lock);
        list_add_tail(&ref_node->node, &file_data->ref_list);
-       spin_unlock(&file_data->lock);
+       spin_unlock_bh(&file_data->lock);
        percpu_ref_get(&file_data->refs);
        return ret;
 out_fput:
@@ -7863,10 +7863,10 @@ static int __io_sqe_files_update(struct io_ring_ctx *ctx,
 
        if (needs_switch) {
                percpu_ref_kill(&data->node->refs);
-               spin_lock(&data->lock);
+               spin_lock_bh(&data->lock);
                list_add_tail(&ref_node->node, &data->ref_list);
                data->node = ref_node;
-               spin_unlock(&data->lock);
+               spin_unlock_bh(&data->lock);
                percpu_ref_get(&ctx->file_data->refs);
        } else
                destroy_fixed_file_ref_node(ref_node);