Re: [PATCH next] io-wq: fix use-after-free in io_wq_worker_running

[Jens Axboe <axboe@kernel.dk>]

On 9/26/20 7:26 AM, Hillf Danton wrote:
> --- a/fs/io-wq.c
> +++ b/fs/io-wq.c
> @@ -200,7 +200,6 @@ static void io_worker_exit(struct io_wor
>  {
>  	struct io_wqe *wqe = worker->wqe;
>  	struct io_wqe_acct *acct = io_wqe_get_acct(wqe, worker);
> -	unsigned nr_workers;
>  
>  	/*
>  	 * If we're not at zero, someone else is holding a brief reference
> @@ -228,15 +227,11 @@ static void io_worker_exit(struct io_wor
>  		raw_spin_lock_irq(&wqe->lock);
>  	}
>  	acct->nr_workers--;
> -	nr_workers = wqe->acct[IO_WQ_ACCT_BOUND].nr_workers +
> -			wqe->acct[IO_WQ_ACCT_UNBOUND].nr_workers;
>  	raw_spin_unlock_irq(&wqe->lock);
>  
> -	/* all workers gone, wq exit can proceed */
> -	if (!nr_workers && refcount_dec_and_test(&wqe->wq->refs))
> -		complete(&wqe->wq->done);
> -
>  	kfree_rcu(worker, rcu);
> +	if (refcount_dec_and_test(&wqe->wq->refs))
> +		complete(&wqe->wq->done);
>  }

Nice, we came up with the same fix, thanks a lot for looking into this.
I pushed this one out for syzbot to test:

https://git.kernel.dk/cgit/linux-block/commit/?h=io_uring-5.9&id=41d5f92f60a61e264dafbada79175dad0bc60c5b

which is basically identical. I did consider the EXIT check as well, but
we don't really need it, so I'd prefer to leave that out of it.

I'll queue yours up.

-- 
Jens Axboe