io_uring: drop mm and files after task_work_run
authorPavel Begunkov <asml.silence@gmail.com>
Mon, 11 Jan 2021 04:00:30 +0000 (04:00 +0000)
committerJens Axboe <axboe@kernel.dk>
Mon, 11 Jan 2021 14:39:54 +0000 (07:39 -0700)
commitd434ab6db524ab1efd0afad4ffa1ee65ca6ac097
tree71234160cb83e0ba6b7ee49e36ae2cf32b3b903b
parentd9d05217cb6990b9a56e13b56e7a1b71e2551f6c
io_uring: drop mm and files after task_work_run

__io_req_task_submit() run by task_work can set mm and files, but
io_sq_thread() in some cases, and because __io_sq_thread_acquire_mm()
and __io_sq_thread_acquire_files() do a simple current->mm/files check
it may end up submitting IO with mm/files of another task.

We also need to drop it after in the end to drop potentially grabbed
references to them.

Cc: stable@vger.kernel.org # 5.9+
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
fs/io_uring.c