io_uring: fix files cancellation (bee749b1) · Commits · 戴 / test

io_uring_cancel_files()'s task check condition mistakenly got flipped. 1. There can't be a request in the inflight list without IO_WQ_WORK_FILES, kill this check to keep the whole condition simpler. 2. Also, don't call the function for files==NULL to not do such a check, all that staff is already handled well by its counter part, __io_uring_cancel_task_requests(). With that just flip the task check. Also, it iowq-cancels all request of current task there, don't forget to set right ->files into struct io_task_cancel. Fixes: c1973b38bf639 ("io_uring: cancel only requests of current task") Reported-by:

<syzbot+c0d52d0b3c0c3ffb9525@syzkaller.appspotmail.com> Signed-off-by:

Pavel Begunkov <asml.silence@gmail.com> Signed-off-by:

Jens Axboe <axboe@kernel.dk>

fs/io_uring.c

+4 −4

Original line number	Diff line number	Diff line
		@@ -8688,15 +8688,14 @@ static void io_uring_cancel_files(struct io_ring_ctx *ctx,
		struct files_struct *files)
		{
		while (!list_empty_careful(&ctx->inflight_list)) {
		struct io_task_cancel cancel = { .task = task, .files = NULL, };
		struct io_task_cancel cancel = { .task = task, .files = files };
		struct io_kiocb *req;
		DEFINE_WAIT(wait);
		bool found = false;

		spin_lock_irq(&ctx->inflight_lock);
		list_for_each_entry(req, &ctx->inflight_list, inflight_entry) {
		if (req->task == task &&
		(req->work.flags & IO_WQ_WORK_FILES) &&
		if (req->task != task \|\|
		req->work.identity->files != files)
		continue;
		found = true;
		@@ -8768,10 +8767,11 @@ static void io_uring_cancel_task_requests(struct io_ring_ctx *ctx,

		io_cancel_defer_files(ctx, task, files);
		io_cqring_overflow_flush(ctx, true, task, files);
		io_uring_cancel_files(ctx, task, files);

		if (!files)
		__io_uring_cancel_task_requests(ctx, task);
		else
		io_uring_cancel_files(ctx, task, files);

		if ((ctx->flags & IORING_SETUP_SQPOLL) && ctx->sq_data) {
		atomic_dec(&task->io_uring->in_idle);

Admin message