From: Jens Axboe <axboe@kernel.dk>
Date: Mon, 20 Dec 2021 20:32:24 -0700
Subject: [PATCH] block: fix error in handling dead task for ioprio setting
Git-commit: a957b61254a7d59a6c14ee2ac2db20a62eb299a1
Patch-mainline: v5.17-rc1
References: jsc#PED-1183

Don't combine the task exiting and "already have io_context" case, we
need to just abort if the task is marked as dead. Return -ESRCH, which
is the documented value for ioprio_set() if the specified task could not
be found.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Reported-by: syzbot+8836466a79f4175961b0@syzkaller.appspotmail.com
Fixes: 5fc11eebb4a9 ("block: open code create_task_io_context in set_task_ioprio")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Acked-by: Hannes Reinecke <hare@suse.com>
---
 block/blk-ioc.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/block/blk-ioc.c b/block/blk-ioc.c
index 87bdc9ca8295..71c3a933cf16 100644
--- a/block/blk-ioc.c
+++ b/block/blk-ioc.c
@@ -279,7 +279,12 @@ int set_task_ioprio(struct task_struct *task, int ioprio)
 			return -ENOMEM;
 
 		task_lock(task);
-		if (task->io_context || (task->flags & PF_EXITING)) {
+		if (task->flags & PF_EXITING) {
+			err = -ESRCH;
+			kmem_cache_free(iocontext_cachep, ioc);
+			goto out;
+		}
+		if (task->io_context) {
 			kmem_cache_free(iocontext_cachep, ioc);
 			ioc = task->io_context;
 		} else {
@@ -287,8 +292,9 @@ int set_task_ioprio(struct task_struct *task, int ioprio)
 		}
 	}
 	task->io_context->ioprio = ioprio;
+out:
 	task_unlock(task);
-	return 0;
+	return err;
 }
 EXPORT_SYMBOL_GPL(set_task_ioprio);
 
-- 
2.35.3