diff options
| author | Jens Axboe <axboe@kernel.dk> | 2026-05-11 19:58:56 +0300 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2026-05-11 20:14:38 +0300 |
| commit | a65855ec34aed84e1e5b4aea0323cc1745f83a5c (patch) | |
| tree | 7377de21352c7cf713154df63e5613c6d03dbfb4 | |
| parent | 49ae66eb8c27375075ffa308cfd4bf25af335d41 (diff) | |
| download | linux-a65855ec34aed84e1e5b4aea0323cc1745f83a5c.tar.xz | |
io_uring: hold uring_lock across io_kill_timeouts() in cancel path
io_uring_try_cancel_requests() dropped ctx->uring_lock before calling
io_kill_timeouts(), which walks each timeout's link chain via
io_match_task() to test REQ_F_INFLIGHT. With chain mutation now
serialized by ctx->uring_lock, that walk needs the lock too.
Signed-off-by: Jens Axboe <axboe@kernel.dk>
| -rw-r--r-- | io_uring/cancel.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/io_uring/cancel.c b/io_uring/cancel.c index 5e5eb9cfc7cd..4aa3103ba9c3 100644 --- a/io_uring/cancel.c +++ b/io_uring/cancel.c @@ -561,8 +561,8 @@ __cold bool io_uring_try_cancel_requests(struct io_ring_ctx *ctx, ret |= io_waitid_remove_all(ctx, tctx, cancel_all); ret |= io_futex_remove_all(ctx, tctx, cancel_all); ret |= io_uring_try_cancel_uring_cmd(ctx, tctx, cancel_all); - mutex_unlock(&ctx->uring_lock); ret |= io_kill_timeouts(ctx, tctx, cancel_all); + mutex_unlock(&ctx->uring_lock); if (tctx) ret |= io_run_task_work() > 0; else |