This is a note to let you know that I've just added the patch titled
io_uring: reference ->nsproxy for file table commands
to the 5.8-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
io_uring-reference-nsproxy-for-file-table-commands.patch
and it can be found in the queue-5.8 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From foo@baz Thu Oct 29 01:16:54 PM CET 2020
From: Jens Axboe <axboe@xxxxxxxxx>
Date: Fri, 18 Sep 2020 20:13:06 -0600
Subject: io_uring: reference ->nsproxy for file table commands
From: Jens Axboe <axboe@xxxxxxxxx>
commit 9b8284921513fc1ea57d87777283a59b05862f03 upstream.
If we don't get and assign the namespace for the async work, then certain
paths just don't work properly (like /dev/stdin, /proc/mounts, etc).
Anything that references the current namespace of the given task should
be assigned for async work on behalf of that task.
Cc: stable@xxxxxxxxxxxxxxx # v5.5+
Reported-by: Al Viro <viro@xxxxxxxxxxxxxxxxxx>
Signed-off-by: Jens Axboe <axboe@xxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
fs/io-wq.c | 4 ++++
fs/io-wq.h | 1 +
fs/io_uring.c | 3 +++
3 files changed, 8 insertions(+)
--- a/fs/io-wq.c
+++ b/fs/io-wq.c
@@ -60,6 +60,7 @@ struct io_worker {
const struct cred *cur_creds;
const struct cred *saved_creds;
struct files_struct *restore_files;
+ struct nsproxy *restore_nsproxy;
struct fs_struct *restore_fs;
};
@@ -153,6 +154,7 @@ static bool __io_worker_unuse(struct io_
task_lock(current);
current->files = worker->restore_files;
+ current->nsproxy = worker->restore_nsproxy;
task_unlock(current);
}
@@ -318,6 +320,7 @@ static void io_worker_start(struct io_wq
worker->flags |= (IO_WORKER_F_UP | IO_WORKER_F_RUNNING);
worker->restore_files = current->files;
+ worker->restore_nsproxy = current->nsproxy;
worker->restore_fs = current->fs;
io_wqe_inc_running(wqe, worker);
}
@@ -454,6 +457,7 @@ static void io_impersonate_work(struct i
if (work->files && current->files != work->files) {
task_lock(current);
current->files = work->files;
+ current->nsproxy = work->nsproxy;
task_unlock(current);
}
if (work->fs && current->fs != work->fs)
--- a/fs/io-wq.h
+++ b/fs/io-wq.h
@@ -88,6 +88,7 @@ struct io_wq_work {
struct files_struct *files;
struct mm_struct *mm;
const struct cred *creds;
+ struct nsproxy *nsproxy;
struct fs_struct *fs;
unsigned flags;
};
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -1456,6 +1456,7 @@ static void io_req_drop_files(struct io_
spin_unlock_irqrestore(&ctx->inflight_lock, flags);
req->flags &= ~REQ_F_INFLIGHT;
put_files_struct(req->work.files);
+ put_nsproxy(req->work.nsproxy);
req->work.files = NULL;
}
@@ -5685,6 +5686,8 @@ static int io_grab_files(struct io_kiocb
return 0;
req->work.files = get_files_struct(current);
+ get_nsproxy(current->nsproxy);
+ req->work.nsproxy = current->nsproxy;
req->flags |= REQ_F_INFLIGHT;
spin_lock_irq(&ctx->inflight_lock);
Patches currently in stable-queue which might be from axboe@xxxxxxxxx are
queue-5.8/io_uring-convert-advanced-xarray-uses-to-the-normal-api.patch
queue-5.8/io_uring-don-t-run-task-work-on-an-exiting-task.patch
queue-5.8/io_uring-reference-nsproxy-for-file-table-commands.patch
queue-5.8/io_uring-stash-ctx-task-reference-for-sqpoll.patch
queue-5.8/io_uring-return-cancelation-status-from-poll-timeout-files-handlers.patch
queue-5.8/io_uring-fix-xarray-usage-in-io_uring_add_task_file.patch
queue-5.8/io_uring-fix-use-of-xarray-in-__io_uring_files_cancel.patch
queue-5.8/io-wq-fix-use-after-free-in-io_wq_worker_running.patch
queue-5.8/io_uring-don-t-rely-on-weak-files-references.patch
queue-5.8/io_uring-allow-timeout-poll-files-killing-to-take-task-into-account.patch
queue-5.8/io_uring-move-dropping-of-files-into-separate-helper.patch
queue-5.8/io_uring-unconditionally-grab-req-task.patch
queue-5.8/io_uring-enable-task-files-specific-overflow-flushing.patch
queue-5.8/io_wq-make-io_wqe-lock-a-raw_spinlock_t.patch
queue-5.8/io_uring-no-need-to-call-xa_destroy-on-empty-xarray.patch
