aboutsummaryrefslogtreecommitdiffstats
path: root/fs/io_uring.c
diff options
context:
space:
mode:
authorPavel Begunkov <asml.silence@gmail.com>2020-03-07 01:15:22 +0300
committerJens Axboe <axboe@kernel.dk>2020-03-07 08:35:56 -0700
commitf0e20b8943509d81200cef5e30af2adfddba0f5c (patch)
tree7dccd88cdb089208a69c95de6a3d11ed7737b057 /fs/io_uring.c
parentio_uring: free fixed_file_data after RCU grace period (diff)
downloadlinux-dev-f0e20b8943509d81200cef5e30af2adfddba0f5c.tar.xz
linux-dev-f0e20b8943509d81200cef5e30af2adfddba0f5c.zip
io_uring: fix lockup with timeouts
There is a recipe to deadlock the kernel: submit a timeout sqe with a linked_timeout (e.g. test_single_link_timeout_ception() from liburing), and SIGKILL the process. Then, io_kill_timeouts() takes @ctx->completion_lock, but the timeout isn't flagged with REQ_F_COMP_LOCKED, and will try to double grab it during io_put_free() to cancel the linked timeout. Probably, the same can happen with another io_kill_timeout() call site, that is io_commit_cqring(). Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to '')
-rw-r--r--fs/io_uring.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/fs/io_uring.c b/fs/io_uring.c
index 68050b61ad0e..c06082bb039a 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -1000,6 +1000,7 @@ static void io_kill_timeout(struct io_kiocb *req)
if (ret != -1) {
atomic_inc(&req->ctx->cq_timeouts);
list_del_init(&req->list);
+ req->flags |= REQ_F_COMP_LOCKED;
io_cqring_fill_event(req, 0);
io_put_req(req);
}