[PATCH 1/1] io_uring: fix drain stalls by invalid SQE

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]


cq_extra is protected by ->completion_lock, which io_get_sqe() misses.
The bug is harmless as it doesn't happen in real life, requires invalid
SQ index array and racing with submission, and only messes up the
userspace, i.e. stall requests execution but will be cleaned up on
ring destruction.

Fixes: 15641e427070f ("io_uring: don't cache number of dropped SQEs")
Signed-off-by: Pavel Begunkov <asml.silence@xxxxxxxxx>
 io_uring/io_uring.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index e70cf5c2dc7f..0eed797ef270 100644
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -2390,7 +2390,9 @@ static bool io_get_sqe(struct io_ring_ctx *ctx, const struct io_uring_sqe **sqe)
 	/* drop invalid entries */
+	spin_lock(&ctx->completion_lock);
+	spin_unlock(&ctx->completion_lock);
 		   READ_ONCE(ctx->rings->sq_dropped) + 1);
 	return false;

[Index of Archives]     [Linux Samsung SoC]     [Linux Rockchip SoC]     [Linux Actions SoC]     [Linux for Synopsys ARC Processors]     [Linux NFS]     [Linux NILFS]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux