diff options
| author | Pavel Begunkov <asml.silence@gmail.com> | 2024-12-28 18:44:52 +0100 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2024-12-28 21:13:22 +0100 |
| commit | 38fc96a58ce40257aec79b32e9b310c86907c63c (patch) | |
| tree | c7208b2aa74c109479f353f2dfbad47968493dc0 | |
| parent | io_uring/sqpoll: fix sqpoll error handling races (diff) | |
| download | linux-38fc96a58ce40257aec79b32e9b310c86907c63c.tar.xz linux-38fc96a58ce40257aec79b32e9b310c86907c63c.zip | |
io_uring/rw: fix downgraded mshot read
The io-wq path can downgrade a multishot request to oneshot mode,
however io_read_mshot() doesn't handle that and would still post
multiple CQEs. That's not allowed, because io_req_post_cqe() requires
stricter context requirements.
The described can only happen with pollable files that don't support
FMODE_NOWAIT, which is an odd combination, so if even allowed it should
be fairly rare.
Cc: stable@vger.kernel.org
Reported-by: chase xd <sl1589472800@gmail.com>
Fixes: bee1d5becdf5b ("io_uring: disable io-wq execution of multishot NOWAIT requests")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/c5c8c4a50a882fd581257b81bf52eee260ac29fd.1735407848.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
| -rw-r--r-- | io_uring/rw.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/io_uring/rw.c b/io_uring/rw.c index 0bcb83e4ce3c..29bb3010f9c0 100644 --- a/io_uring/rw.c +++ b/io_uring/rw.c @@ -983,6 +983,8 @@ int io_read_mshot(struct io_kiocb *req, unsigned int issue_flags) io_kbuf_recycle(req, issue_flags); if (ret < 0) req_set_fail(req); + } else if (!(req->flags & REQ_F_APOLL_MULTISHOT)) { + cflags = io_put_kbuf(req, ret, issue_flags); } else { /* * Any successful return value will keep the multishot read |