diff options
| author | Jens Axboe <axboe@kernel.dk> | 2025-01-15 09:05:15 -0700 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-03-22 12:54:14 -0700 |
| commit | aa189c394168ad53d8eacb82a1cc258d2cd90129 (patch) | |
| tree | b70783bae8b809079285536bdc4a809eaf177bed /io_uring | |
| parent | fb51a7209398054c88b8750937ebbac4931bb0d2 (diff) | |
| download | linux-aa189c394168ad53d8eacb82a1cc258d2cd90129.tar.gz linux-aa189c394168ad53d8eacb82a1cc258d2cd90129.tar.bz2 linux-aa189c394168ad53d8eacb82a1cc258d2cd90129.zip | |
futex: Pass in task to futex_queue()
[ Upstream commit 5e0e02f0d7e52cfc8b1adfc778dd02181d8b47b4 ]
futex_queue() -> __futex_queue() uses 'current' as the task to store in
the struct futex_q->task field. This is fine for synchronous usage of
the futex infrastructure, but it's not always correct when used by
io_uring where the task doing the initial futex_queue() might not be
available later on. This doesn't lead to any issues currently, as the
io_uring side doesn't support PI futexes, but it does leave a
potentially dangling pointer which is never a good idea.
Have futex_queue() take a task_struct argument, and have the regular
callers pass in 'current' for that. Meanwhile io_uring can just pass in
NULL, as the task should never be used off that path. In theory
req->tctx->task could be used here, but there's no point populating it
with a task field that will never be used anyway.
Reported-by: Jann Horn <jannh@google.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/all/22484a23-542c-4003-b721-400688a0d055@kernel.dk
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'io_uring')
| -rw-r--r-- | io_uring/futex.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/io_uring/futex.c b/io_uring/futex.c index 914848f46beb..01f044f89f8f 100644 --- a/io_uring/futex.c +++ b/io_uring/futex.c @@ -349,7 +349,7 @@ int io_futex_wait(struct io_kiocb *req, unsigned int issue_flags) hlist_add_head(&req->hash_node, &ctx->futex_list); io_ring_submit_unlock(ctx, issue_flags); - futex_queue(&ifd->q, hb); + futex_queue(&ifd->q, hb, NULL); return IOU_ISSUE_SKIP_COMPLETE; } |