[SRU Kinetic 1/1] io_uring: hold uring mutex around poll removal

[Thadeu Lima de Souza Cascardo]

From: Jens Axboe <axboe at kernel.dk>

Snipped from commit 9ca9fb24d5febccea354089c41f96a8ad0d853f8 upstream.

While reworking the poll hashing in the v6.0 kernel, we ended up
grabbing the ctx->uring_lock in poll update/removal. This also fixed
a bug with linked timeouts racing with timeout expiry and poll
removal.

Bring back just the locking fix for that.

Reported-and-tested-by: Querijn Voet <querijnqyn at gmail.com>
Signed-off-by: Jens Axboe <axboe at kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
(backported from commit 0e388fce7aec40992eadee654193cad345d62663 linux-5.15.y)
CVE-2023-3389
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo at canonical.com>
---
 io_uring/io_uring.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index 5e3e26cb513d..2cd2626b9ea2 100644
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -7329,6 +7329,8 @@ static int io_poll_remove(struct io_kiocb *req, unsigned int issue_flags)
 	int ret2, ret = 0;
 	bool locked;
 
+	io_ring_submit_lock(ctx, !(issue_flags & IO_URING_F_NONBLOCK));
+
 	spin_lock(&ctx->completion_lock);
 	preq = io_poll_find(ctx, true, &cd);
 	if (!preq || !io_poll_disarm(preq)) {
@@ -7363,6 +7365,7 @@ static int io_poll_remove(struct io_kiocb *req, unsigned int issue_flags)
 		req_set_fail(req);
 	/* complete update request, we're done with it */
 	__io_req_complete(req, issue_flags, ret, 0);
+	io_ring_submit_unlock(ctx, !(issue_flags & IO_URING_F_NONBLOCK));
 	return 0;
 }
 
-- 
2.34.1