This is a note to let you know that I've just added the patch titled io_uring: don't set COMP_LOCKED if won't put to the 5.9-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: io_uring-don-t-set-comp_locked-if-won-t-put.patch and it can be found in the queue-5.9 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. commit 6ad6d8e2917f309e12ba92f001536d2d05409d01 Author: Pavel Begunkov <asml.silence@xxxxxxxxx> Date: Tue Oct 13 09:43:56 2020 +0100 io_uring: don't set COMP_LOCKED if won't put [ Upstream commit 368c5481ae7c6a9719c40984faea35480d9f4872 ] __io_kill_linked_timeout() sets REQ_F_COMP_LOCKED for a linked timeout even if it can't cancel it, e.g. it's already running. It not only races with io_link_timeout_fn() for ->flags field, but also leaves the flag set and so io_link_timeout_fn() may find it and decide that it holds the lock. Hopefully, the second problem is potential. Signed-off-by: Pavel Begunkov <asml.silence@xxxxxxxxx> Signed-off-by: Jens Axboe <axboe@xxxxxxxxx> Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx> diff --git a/fs/io_uring.c b/fs/io_uring.c index 59ab8c5c2aaaa..50a7a99dad4ca 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -1650,6 +1650,7 @@ static bool io_link_cancel_timeout(struct io_kiocb *req) ret = hrtimer_try_to_cancel(&req->io->timeout.timer); if (ret != -1) { + req->flags |= REQ_F_COMP_LOCKED; io_cqring_fill_event(req, -ECANCELED); io_commit_cqring(ctx); req->flags &= ~REQ_F_LINK_HEAD; @@ -1672,7 +1673,6 @@ static bool __io_kill_linked_timeout(struct io_kiocb *req) return false; list_del_init(&link->link_list); - link->flags |= REQ_F_COMP_LOCKED; wake_ev = io_link_cancel_timeout(link); req->flags &= ~REQ_F_LINK_TIMEOUT; return wake_ev;