COREDUMP_CLOSE_FILES allows userspace to request to drop the descriptor tables of the thread-group before the coredump is written. io_uring requests the threads had in flight survive and say a poll-triggered accept can install a descriptor into whatever table the thread has at that point. Since the whole thread-group is going down in a coredump do what exec does after de_thread() and cancel everything. After that no io_uring task work can be queued to the thread anymore. Signed-off-by: Christian Brauner (Amutable) --- fs/coredump.c | 5 ++++- kernel/exit.c | 1 + 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/fs/coredump.c b/fs/coredump.c index 4ffd801aca01..87befc5df961 100644 --- a/fs/coredump.c +++ b/fs/coredump.c @@ -40,6 +40,7 @@ #include #include #include +#include #include #include #include @@ -576,8 +577,10 @@ static bool coredump_close_files(struct core_state *core_state) } /* Use the dumper's real creds not the overridden ones. */ - scoped_with_creds(current_real_cred()) + scoped_with_creds(current_real_cred()) { + io_uring_task_cancel(); switch_files_struct(current, files); + } coredump_wait_inactive(core_state); return true; diff --git a/kernel/exit.c b/kernel/exit.c index 04f2c8c78879..4c94a475b958 100644 --- a/kernel/exit.c +++ b/kernel/exit.c @@ -452,6 +452,7 @@ static void coredump_task_exit(struct task_struct *tsk, /* Pairs with the release in coredump_close_files(). */ if (smp_load_acquire(&self.files)) { __set_current_state(TASK_RUNNING); + io_uring_task_cancel(); switch_files_struct(tsk, no_free_ptr(self.files)); atomic_dec_and_wake_up(&core_state->threads_remaining); continue; -- 2.53.0