[PATCH 2/2] io_uring: fix UAF for io_buffer_idr

[yangerkun <yangerkun@xxxxxxxxxx>]

The same as personality_idr, stop call idr_remove in idr_for_each.

Reported-by: Hulk Robot <hulkci@xxxxxxxxxx>
Signed-off-by: yangerkun <yangerkun@xxxxxxxxxx>
---
 fs/io_uring.c | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)

diff --git a/fs/io_uring.c b/fs/io_uring.c
index b462c2bf0f2c..7c3011756994 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -3850,8 +3850,8 @@ static int io_remove_buffers_prep(struct io_kiocb *req,
 	return 0;
 }
 
-static int __io_remove_buffers(struct io_ring_ctx *ctx, struct io_buffer *buf,
-			       int bgid, unsigned nbufs)
+static int __io_free_buffers(struct io_ring_ctx *ctx, struct io_buffer *buf,
+			       int bgid, unsigned int nbufs)
 {
 	unsigned i = 0;
 
@@ -3871,11 +3871,16 @@ static int __io_remove_buffers(struct io_ring_ctx *ctx, struct io_buffer *buf,
 	}
 	i++;
 	kfree(buf);
-	idr_remove(&ctx->io_buffer_idr, bgid);
-
 	return i;
 }
 
+static int __io_remove_buffers(struct io_ring_ctx *ctx, struct io_buffer *buf,
+			       int bgid, unsigned int nbufs)
+{
+	idr_remove(&ctx->io_buffer_idr, bgid);
+	return __io_free_buffers(ctx, buf, bgid, nbufs);
+}
+
 static int io_remove_buffers(struct io_kiocb *req, unsigned int issue_flags)
 {
 	struct io_provide_buf *p = &req->pbuf;
@@ -8345,18 +8350,18 @@ static int io_eventfd_unregister(struct io_ring_ctx *ctx)
 	return -ENXIO;
 }
 
-static int __io_destroy_buffers(int id, void *p, void *data)
+static int io_free_buffers(int id, void *p, void *data)
 {
 	struct io_ring_ctx *ctx = data;
 	struct io_buffer *buf = p;
 
-	__io_remove_buffers(ctx, buf, id, -1U);
+	__io_free_buffers(ctx, buf, id, -1U);
 	return 0;
 }
 
 static void io_destroy_buffers(struct io_ring_ctx *ctx)
 {
-	idr_for_each(&ctx->io_buffer_idr, __io_destroy_buffers, ctx);
+	idr_for_each(&ctx->io_buffer_idr, io_free_buffers, ctx);
 	idr_destroy(&ctx->io_buffer_idr);
 }
 
-- 
2.25.4