io_uring: mem-account pbuf buckets

commit dfbb8b1feeb5ce880eff2b9c2f0af2a691882f9b upstream.

Potentially, someone may create as many pbuf bucket as there are indexes
in an xarray without any other restrictions bounding our memory usage,
put memory needed for the buckets under memory accounting.

Cc: <stable@vger.kernel.org>
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/d34c452e45793e978d26e2606211ec9070d329ea.1659622312.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 9bff14c5e2b265cd56d590110666cd0e26534511..0ce1587df4322101ccae9dbe492c91dc6602def2 100644 (file)
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -4477,7 +4477,8 @@ static int io_provide_buffers(struct io_kiocb *req, unsigned int issue_flags)
 
        ret = io_add_buffers(p, &head);
        if (ret >= 0 && !list) {
-               ret = xa_insert(&ctx->io_buffers, p->bgid, head, GFP_KERNEL);
+               ret = xa_insert(&ctx->io_buffers, p->bgid, head,
+                               GFP_KERNEL_ACCOUNT);
                if (ret < 0)
                        __io_remove_buffers(ctx, head, p->bgid, -1U);
        }