OpenSDV
/
original_kernel
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

io_uring-6.10-20240614 

-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmZsY78QHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgppBzEADdmuV9pgx3fGp1f+4XVdzu053z7HWFj6RU
 gQ0cLAL5p0Yx5s+wYG64CC2eluYy7cPxvrfCXoMAdNnFsSSYIPDDerI3ZZ6vt5ft
 m0yHJQx3V0j9ZCqcGFw9PxkOmCOx3jPKe+xkclE1rLIht/lNJd3GaNT8QuXTGcKz
 FqRJ1Jd2a+Rt1/QXJhA/HjFGLTHrpAzFNfmzhCmoVtTJQ9fjw/JNJ7jzrX9p4V8i
 guUBawWVCOOOED1ieg84qCZKIRzaIhgjvo8klELN1dvEKyjqzJUBI7qg1S6GePwy
 rGMuWJHQcOnXvp9+PZ3V9Zs6hGB/NHzOuNJMZ+n8LEm13UGBEcoysRwdcfcZh+jE
 D8NWxofsKeAveoNiKXIZxuZvYQN0RG7+BjBTBbTsr6z/Q/s4r4ll+baQ4lLReiPh
 oC4VKwsTQ3hzpHPomY5r9ZEI3JQOuM8+I2ILLZ26xP+lWyTyrQ8CUEiOCVBPhx8A
 TLRPydRp7V453E1/DjlB7L/oOC6ZBWZqg72kyBj3En8j8KVB1NRJcIuaBrMn+Fi4
 0cgUCmOJQz1ep38j43vwGuRsCVWoZNZ18L2JhhViMFnPh6rw/SlcLSh00ei4cl7v
 BEEJkeYNGyXxkozp7pj7I8CAm3gM3nyy6ULFd9X4vKVBnvnj7aTnQIH4hKd29z/u
 UoNwHCHiSA==
 =bA5c
 -----END PGP SIGNATURE-----

Merge tag 'io_uring-6.10-20240614' of git://git.kernel.dk/linux

Pull io_uring fixes from Jens Axboe:
 "Two fixes from Pavel headed to stable:

   - Ensure that the task state is correct before attempting to grab a
     mutex

   - Split cancel sequence flag into a separate variable, as it can get
     set by someone not owning the request (but holding the ctx lock)"

* tag 'io_uring-6.10-20240614' of git://git.kernel.dk/linux:
  io_uring: fix cancellation overwriting req->flags
  io_uring/rsrc: don't lock while !TASK_RUNNING
This commit is contained in:
Linus Torvalds 2024-06-14 11:17:24 -07:00
parent 0b320c8601 f4a1254f2a
commit ac3cb72aea
4 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
include/linux/io_uring_types.h
View File

@ -648,7 +648,7 @@ struct io_kiocb {
struct io_rsrc_node *rsrc_node;
atomic_t refs;
atomic_t poll_refs;
bool cancel_seq_set;
struct io_task_work io_task_work;
/* for polled requests, i.e. IORING_OP_POLL_ADD and async armed poll */
struct hlist_node hash_node;
@ -657,6 +657,7 @@ struct io_kiocb {
/* opcode allocated if it needs to store data for async defer */
void *async_data;
/* linked requests, IFF REQ_F_HARDLINK or REQ_F_LINK are set */
atomic_t poll_refs;
struct io_kiocb *link;
/* custom credentials, valid IFF REQ_F_CREDS is set */
const struct cred *creds;

4
io_uring/cancel.h
View File

@ -27,10 +27,10 @@ bool io_cancel_req_match(struct io_kiocb *req, struct io_cancel_data *cd);
static inline bool io_cancel_match_sequence(struct io_kiocb *req, int sequence)
{
if ((req->flags & REQ_F_CANCEL_SEQ) && sequence == req->work.cancel_seq)
if (req->cancel_seq_set && sequence == req->work.cancel_seq)
return true;
req->flags |= REQ_F_CANCEL_SEQ;
req->cancel_seq_set = true;
req->work.cancel_seq = sequence;
return false;
}

1
io_uring/io_uring.c
View File

@ -2058,6 +2058,7 @@ static int io_init_req(struct io_ring_ctx *ctx, struct io_kiocb *req,
req->file = NULL;
req->rsrc_node = NULL;
req->task = current;
req->cancel_seq_set = false;
if (unlikely(opcode >= IORING_OP_LAST)) {
req->opcode = 0;

1
io_uring/rsrc.c
View File

@ -249,6 +249,7 @@ __cold static int io_rsrc_ref_quiesce(struct io_rsrc_data *data,
ret = io_run_task_work_sig(ctx);
if (ret < 0) {
__set_current_state(TASK_RUNNING);
mutex_lock(&ctx->uring_lock);
if (list_empty(&ctx->rsrc_ref_list))
ret = 0;