diff options
| author | Pavel Begunkov <asml.silence@gmail.com> | 2020-11-25 19:41:28 +0100 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2020-11-26 16:50:21 +0100 |
| commit | af60470347de6ac2b9f0cc3703975a543a3de075 (patch) | |
| tree | 6b0d7677d948ebb14a02c02fca16c9f63d6644cb /kernel | |
| parent | io_uring: fix ITER_BVEC check (diff) | |
| download | linux-af60470347de6ac2b9f0cc3703975a543a3de075.tar.xz linux-af60470347de6ac2b9f0cc3703975a543a3de075.zip | |
io_uring: fix files grab/cancel race
When one task is in io_uring_cancel_files() and another is doing
io_prep_async_work() a race may happen. That's because after accounting
a request inflight in first call to io_grab_identity() it still may fail
and go to io_identity_cow(), which migh briefly keep dangling
work.identity and not only.
Grab files last, so io_prep_async_work() won't fail if it did get into
->inflight_list.
note: the bug shouldn't exist after making io_uring_cancel_files() not
poking into other tasks' requests.
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'kernel')
0 files changed, 0 insertions, 0 deletions