io_uring/sqpoll: fix sqpoll error handling races

JIRA: https://issues.redhat.com/browse/RHEL-106845

commit e33ac68
Author: Pavel Begunkov <[email protected]>
Date:   Thu Dec 26 16:49:23 2024 +0000

    io_uring/sqpoll: fix sqpoll error handling races

    BUG: KASAN: slab-use-after-free in __lock_acquire+0x370b/0x4a10 kernel/locking/lockdep.c:5089
    Call Trace:
    <TASK>
    ...
    _raw_spin_lock_irqsave+0x3d/0x60 kernel/locking/spinlock.c:162
    class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:551 [inline]
    try_to_wake_up+0xb5/0x23c0 kernel/sched/core.c:4205
    io_sq_thread_park+0xac/0xe0 io_uring/sqpoll.c:55
    io_sq_thread_finish+0x6b/0x310 io_uring/sqpoll.c:96
    io_sq_offload_create+0x162/0x11d0 io_uring/sqpoll.c:497
    io_uring_create io_uring/io_uring.c:3724 [inline]
    io_uring_setup+0x1728/0x3230 io_uring/io_uring.c:3806
    ...

    Kun Hu reports that the SQPOLL creating error path has UAF, which
    happens if io_uring_alloc_task_context() fails and then io_sq_thread()
    manages to run and complete before the rest of error handling code,
    which means io_sq_thread_finish() is looking at already killed task.

    Note that this is mostly theoretical, requiring fault injection on
    the allocation side to trigger in practice.

    Cc: [email protected]
    Reported-by: Kun Hu <[email protected]>
    Signed-off-by: Pavel Begunkov <[email protected]>
    Link: https://lore.kernel.org/r/0f2f1aa5729332612bd01fe0f2f385fd1f06ce7c.1735231717.git.asml.silence@gmail.com
    Signed-off-by: Jens Axboe <[email protected]>

Signed-off-by: Ming Lei <[email protected]>

Author: Ming Lei

io_uring/sqpoll.c

@@ -417,6 +417,7 @@ void io_sqpoll_wait_sq(struct io_ring_ctx *ctx)
 __cold int io_sq_offload_create(struct io_ring_ctx *ctx,
 				struct io_uring_params *p)
 {
+	struct task_struct *task_to_put = NULL;
 	int ret;
 
 	/* Retain compatibility with failing for an invalid attach attempt */
@@ -497,6 +498,7 @@ __cold int io_sq_offload_create(struct io_ring_ctx *ctx,
 		}
 
 		sqd->thread = tsk;
+		task_to_put = get_task_struct(tsk);
 		ret = io_uring_alloc_task_context(tsk, ctx);
 		wake_up_new_task(tsk);
 		if (ret)
@@ -507,11 +509,15 @@ __cold int io_sq_offload_create(struct io_ring_ctx *ctx,
 		goto err;
 	}
 
+	if (task_to_put)
+		put_task_struct(task_to_put);
 	return 0;
 err_sqpoll:
 	complete(&ctx->sq_data->exited);
 err:
 	io_sq_thread_finish(ctx);
+	if (task_to_put)
+		put_task_struct(task_to_put);
 	return ret;
 }