On 1/30/25 4:38 AM, gregkh@xxxxxxxxxxxxxxxxxxx wrote: > > The patch below does not apply to the 6.12-stable tree. > If someone wants it applied there, or to any other stable or longterm > tree, then please email the backport, including the original git commit > id to <stable@xxxxxxxxxxxxxxx>. > > To reproduce the conflict and resubmit, you may use the following commands: > > git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.12.y > git checkout FETCH_HEAD > git cherry-pick -x 19d340a2988d4f3e673cded9dde405d727d7e248 > # <resolve conflicts, build, test, etc.> > git commit -s > git send-email --to '<stable@xxxxxxxxxxxxxxx>' --in-reply-to '2025013011-scenic-crazed-e3c8@gregkh' --subject-prefix 'PATCH 6.12.y' HEAD^.. Here's a 6.12-stable version of this patch. -- Jens Axboe
From 605dc321522f4334849759d9585bef54dc60994f Mon Sep 17 00:00:00 2001 From: Jann Horn <jannh@xxxxxxxxxx> Date: Tue, 14 Jan 2025 18:49:00 +0100 Subject: [PATCH] io_uring/rsrc: require cloned buffers to share accounting contexts Commit 19d340a2988d4f3e673cded9dde405d727d7e248 upstream. When IORING_REGISTER_CLONE_BUFFERS is used to clone buffers from uring instance A to uring instance B, where A and B use different MMs for accounting, the accounting can go wrong: If uring instance A is closed before uring instance B, the pinned memory counters for uring instance B will be decremented, even though the pinned memory was originally accounted through uring instance A; so the MM of uring instance B can end up with negative locked memory. Cc: stable@xxxxxxxxxxxxxxx Closes: https://lore.kernel.org/r/CAG48ez1zez4bdhmeGLEFxtbFADY4Czn3CV0u9d_TMcbvRA01bg@xxxxxxxxxxxxxx Fixes: 7cc2a6eadcd7 ("io_uring: add IORING_REGISTER_COPY_BUFFERS method") Signed-off-by: Jann Horn <jannh@xxxxxxxxxx> Link: https://lore.kernel.org/r/20250114-uring-check-accounting-v1-1-42e4145aa743@xxxxxxxxxx Signed-off-by: Jens Axboe <axboe@xxxxxxxxx> --- io_uring/rsrc.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c index 6f3b6de230bd..a67bae350416 100644 --- a/io_uring/rsrc.c +++ b/io_uring/rsrc.c @@ -1153,6 +1153,13 @@ static int io_clone_buffers(struct io_ring_ctx *ctx, struct io_ring_ctx *src_ctx struct io_rsrc_data *data; int i, ret, nbufs; + /* + * Accounting state is shared between the two rings; that only works if + * both rings are accounted towards the same counters. + */ + if (ctx->user != src_ctx->user || ctx->mm_account != src_ctx->mm_account) + return -EINVAL; + /* * Drop our own lock here. We'll setup the data we need and reference * the source buffers, then re-grab, check, and assign at the end. -- 2.47.2
