Commit 368c5481 authored Oct 13, 2020 by Pavel Begunkov Committed by Jens Axboe Oct 17, 2020

io_uring: don't set COMP_LOCKED if won't put



__io_kill_linked_timeout() sets REQ_F_COMP_LOCKED for a linked timeout
even if it can't cancel it, e.g. it's already running. It not only races
with io_link_timeout_fn() for ->flags field, but also leaves the flag
set and so io_link_timeout_fn() may find it and decide that it holds the
lock. Hopefully, the second problem is potential.

Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

parent 035fbafc

fs/io_uring.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -1769,6 +1769,7 @@ static bool io_link_cancel_timeout(struct io_kiocb *req)

		ret = hrtimer_try_to_cancel(&io->timer);
		if (ret != -1) {
		req->flags \|= REQ_F_COMP_LOCKED;
		io_cqring_fill_event(req, -ECANCELED);
		io_commit_cqring(ctx);
		req->flags &= ~REQ_F_LINK_HEAD;
		@@ -1791,7 +1792,6 @@ static bool __io_kill_linked_timeout(struct io_kiocb *req)
		return false;

		list_del_init(&link->link_list);
		link->flags \|= REQ_F_COMP_LOCKED;
		wake_ev = io_link_cancel_timeout(link);
		req->flags &= ~REQ_F_LINK_TIMEOUT;
		return wake_ev;

Admin message