summaryrefslogtreecommitdiff
path: root/io_uring/io_uring.c
diff options
context:
space:
mode:
authorPavel Begunkov <asml.silence@gmail.com>2023-08-09 15:21:41 +0300
committerJens Axboe <axboe@kernel.dk>2023-08-09 19:46:46 +0300
commitcfdbaa3a291d6fd2cb4a1a70d74e63b4abc2f5ec (patch)
treee19d60769ab0b9b538f00c6cb1c957f739af4ab3 /io_uring/io_uring.c
parentd4b30eed51d79361c290dc25a1386f5611f4982a (diff)
downloadlinux-cfdbaa3a291d6fd2cb4a1a70d74e63b4abc2f5ec.tar.xz
io_uring: fix drain stalls by invalid SQE
cq_extra is protected by ->completion_lock, which io_get_sqe() misses. The bug is harmless as it doesn't happen in real life, requires invalid SQ index array and racing with submission, and only messes up the userspace, i.e. stall requests execution but will be cleaned up on ring destruction. Fixes: 15641e427070f ("io_uring: don't cache number of dropped SQEs") Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Link: https://lore.kernel.org/r/66096d54651b1a60534bb2023f2947f09f50ef73.1691538547.git.asml.silence@gmail.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'io_uring/io_uring.c')
-rw-r--r--io_uring/io_uring.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index 679bea7c41a6..249cab9c86d1 100644
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -2374,7 +2374,9 @@ static bool io_get_sqe(struct io_ring_ctx *ctx, const struct io_uring_sqe **sqe)
}
/* drop invalid entries */
+ spin_lock(&ctx->completion_lock);
ctx->cq_extra--;
+ spin_unlock(&ctx->completion_lock);
WRITE_ONCE(ctx->rings->sq_dropped,
READ_ONCE(ctx->rings->sq_dropped) + 1);
return false;