io_uring: check if iowq is killed before queuing

JIRA: https://issues.redhat.com/browse/RHEL-106845
CVE: CVE-2024-56709

commit dbd2ca9
Author: Pavel Begunkov <[email protected]>
Date:   Thu Dec 19 19:52:58 2024 +0000

    io_uring: check if iowq is killed before queuing

    task work can be executed after the task has gone through io_uring
    termination, whether it's the final task_work run or the fallback path.
    In this case, task work will find ->io_wq being already killed and
    null'ed, which is a problem if it then tries to forward the request to
    io_queue_iowq(). Make io_queue_iowq() fail requests in this case.

    Note that it also checks PF_KTHREAD, because the user can first close
    a DEFER_TASKRUN ring and shortly after kill the task, in which case
    ->iowq check would race.

    Cc: [email protected]
    Fixes: 50c5225 ("block: implement async io_uring discard cmd")
    Fixes: 773af69 ("io_uring: always reissue from task_work context")
    Reported-by: Will <[email protected]>
    Signed-off-by: Pavel Begunkov <[email protected]>
    Link: https://lore.kernel.org/r/63312b4a2c2bb67ad67b857d17a300e1d3b078e8.1734637909.git.asml.silence@gmail.com
    Signed-off-by: Jens Axboe <[email protected]>

Signed-off-by: Ming Lei <[email protected]>

Author: Ming Lei

io_uring/io_uring.c

@@ -515,7 +515,11 @@ static void io_queue_iowq(struct io_kiocb *req)
 	struct io_uring_task *tctx = req->tctx;
 
 	BUG_ON(!tctx);
-	BUG_ON(!tctx->io_wq);
+
+	if ((current->flags & PF_KTHREAD) || !tctx->io_wq) {
+		io_req_task_queue_fail(req, -ECANCELED);
+		return;
+	}
 
 	/* init ->work of the whole link before punting */
 	io_prep_async_link(req);