diff options
| author | Pavel Begunkov <asml.silence@gmail.com> | 2024-12-19 19:52:58 +0000 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-12-27 14:02:17 +0100 |
| commit | 4f95a2186b7f2af09331e1e8069bcaf34fe019cf (patch) | |
| tree | ea175475422235195983e17fea5408757d71bc9f | |
| parent | 06eb0894896bb666f34ea07e73ec00bca865c76a (diff) | |
| download | linux-4f95a2186b7f2af09331e1e8069bcaf34fe019cf.tar.gz linux-4f95a2186b7f2af09331e1e8069bcaf34fe019cf.tar.bz2 linux-4f95a2186b7f2af09331e1e8069bcaf34fe019cf.zip | |
io_uring: check if iowq is killed before queuing
commit dbd2ca9367eb19bc5e269b8c58b0b1514ada9156 upstream.
task work can be executed after the task has gone through io_uring
termination, whether it's the final task_work run or the fallback path.
In this case, task work will find ->io_wq being already killed and
null'ed, which is a problem if it then tries to forward the request to
io_queue_iowq(). Make io_queue_iowq() fail requests in this case.
Note that it also checks PF_KTHREAD, because the user can first close
a DEFER_TASKRUN ring and shortly after kill the task, in which case
->iowq check would race.
Cc: stable@vger.kernel.org
Fixes: 50c52250e2d74 ("block: implement async io_uring discard cmd")
Fixes: 773af69121ecc ("io_uring: always reissue from task_work context")
Reported-by: Will <willsroot@protonmail.com>
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/63312b4a2c2bb67ad67b857d17a300e1d3b078e8.1734637909.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | io_uring/io_uring.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c index 3fab8ee51548..9849da128364 100644 --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -515,7 +515,11 @@ static void io_queue_iowq(struct io_kiocb *req) struct io_uring_task *tctx = req->task->io_uring; BUG_ON(!tctx); - BUG_ON(!tctx->io_wq); + + if ((current->flags & PF_KTHREAD) || !tctx->io_wq) { + io_req_task_queue_fail(req, -ECANCELED); + return; + } /* init ->work of the whole link before punting */ io_prep_async_link(req); |