io_uring/kbuf: protect io_buffer_list teardown with a reference

commit 6b69c4ab4f685327d9e10caf0d84217ba23a8c4b upstream.

No functional changes in this patch, just in preparation for being able
to keep the buffer list alive outside of the ctx->uring_lock.

Cc: stable@vger.kernel.org # v6.4+
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c
index d5efc7c275c2dae323117c5c95aaf7c1c82e3c97..f7114e808827b28cd32413b30dd5978211423304 100644 (file)
--- a/io_uring/kbuf.c
+++ b/io_uring/kbuf.c
@@ -61,6 +61,7 @@ static int io_buffer_add_list(struct io_ring_ctx *ctx,
         * always under the ->uring_lock, but the RCU lookup from mmap does.
         */
        bl->bgid = bgid;
+       atomic_set(&bl->refs, 1);
        return xa_err(xa_store(&ctx->io_bl_xa, bgid, bl, GFP_KERNEL));
 }
 
@@ -274,6 +275,14 @@ static int __io_remove_buffers(struct io_ring_ctx *ctx,
        return i;
 }
 
+static void io_put_bl(struct io_ring_ctx *ctx, struct io_buffer_list *bl)
+{
+       if (atomic_dec_and_test(&bl->refs)) {
+               __io_remove_buffers(ctx, bl, -1U);
+               kfree_rcu(bl, rcu);
+       }
+}
+
 void io_destroy_buffers(struct io_ring_ctx *ctx)
 {
        struct io_buffer_list *bl;
@@ -283,8 +292,7 @@ void io_destroy_buffers(struct io_ring_ctx *ctx)
 
        xa_for_each(&ctx->io_bl_xa, index, bl) {
                xa_erase(&ctx->io_bl_xa, bl->bgid);
-               __io_remove_buffers(ctx, bl, -1U);
-               kfree_rcu(bl, rcu);
+               io_put_bl(ctx, bl);
        }
 
        /*
@@ -689,9 +697,8 @@ int io_unregister_pbuf_ring(struct io_ring_ctx *ctx, void __user *arg)
        if (!bl->is_mapped)
                return -EINVAL;
 
-       __io_remove_buffers(ctx, bl, -1U);
        xa_erase(&ctx->io_bl_xa, bl->bgid);
-       kfree_rcu(bl, rcu);
+       io_put_bl(ctx, bl);
        return 0;
 }
 

diff --git a/io_uring/kbuf.h b/io_uring/kbuf.h
index 3722e44daf0b36e4853b6027ae5652443c76010a..55e1c888c3f9bc7b3d0f4a75b2211c18f5d16c5f 100644 (file)
--- a/io_uring/kbuf.h
+++ b/io_uring/kbuf.h
@@ -25,6 +25,8 @@ struct io_buffer_list {
        __u16 head;
        __u16 mask;
 
+       atomic_t refs;
+
        /* ring mapped provided buffers */
        __u8 is_mapped;
        /* ring mapped provided buffers, but mmap'ed by application */