Commit 19d340a2 authored by Jann Horn's avatar Jann Horn Committed by Jens Axboe
Browse files

io_uring/rsrc: require cloned buffers to share accounting contexts 

When IORING_REGISTER_CLONE_BUFFERS is used to clone buffers from uring
instance A to uring instance B, where A and B use different MMs for
accounting, the accounting can go wrong:
If uring instance A is closed before uring instance B, the pinned memory
counters for uring instance B will be decremented, even though the pinned
memory was originally accounted through uring instance A; so the MM of
uring instance B can end up with negative locked memory.

Cc: stable@vger.kernel.org
Closes: https://lore.kernel.org/r/CAG48ez1zez4bdhmeGLEFxtbFADY4Czn3CV0u9d_TMcbvRA01bg@mail.gmail.com


Fixes: 7cc2a6ea ("io_uring: add IORING_REGISTER_COPY_BUFFERS method")
Signed-off-by: default avatarJann Horn <jannh@google.com>
Link: https://lore.kernel.org/r/20250114-uring-check-accounting-v1-1-42e4145aa743@google.com


Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent a13030fd

io_uring/rsrc.c

+7 −0
Original line number Diff line number Diff line
@@ -928,6 +928,13 @@ static int io_clone_buffers(struct io_ring_ctx *ctx, struct io_ring_ctx *src_ctx 
	int i, ret, off, nr;

	unsigned int nbufs;



	/*

	 * Accounting state is shared between the two rings; that only works if

	 * both rings are accounted towards the same counters.

	 */

	if (ctx->user != src_ctx->user || ctx->mm_account != src_ctx->mm_account)

		return -EINVAL;



	/* if offsets are given, must have nr specified too */

	if (!arg->nr && (arg->dst_off || arg->src_off))

		return -EINVAL;