coml_nr in ctx_flush_and_put() is not protected by uring_lock, this
may cause problems when accessing it parallelly.
Fixes: d10299e14aae ("io_uring: inline struct io_comp_state")
Signed-off-by: Hao Xu <haoxu@xxxxxxxxxxxxxxxxx>
---
fs/io_uring.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/fs/io_uring.c b/fs/io_uring.c
index c755efdac71f..420f8dfa5327 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -2003,11 +2003,10 @@ static void ctx_flush_and_put(struct io_ring_ctx *ctx)
{
if (!ctx)
return;
- if (ctx->submit_state.compl_nr) {
- mutex_lock(&ctx->uring_lock);
+ mutex_lock(&ctx->uring_lock);
+ if (ctx->submit_state.compl_nr)
io_submit_flush_completions(ctx);
- mutex_unlock(&ctx->uring_lock);
- }
+ mutex_unlock(&ctx->uring_lock);
percpu_ref_put(&ctx->refs);
}
--
2.24.4
