From: Jens Axboe <axboe@xxxxxxxxx>
commit 61bc84c4008812d784c398cfb54118c1ba396dfc upstream.
When the ring is exiting, as part of the shutdown, poll requests are
removed. But io_poll_remove_all() does not remove entries when finding
them, and since completions are done out-of-band, we can find and remove
the same entry multiple times.
We do guard the poll execution by poll ownership, but that does not
exclude us from reissuing a new one once the previous removal ownership
goes away.
This can race with poll execution as well, where we then end up seeing
req->apoll be NULL because a previous task_work requeue finished the
request.
Remove the poll entry when we find it and get ownership of it. This
prevents multiple invocations from finding it.
Fixes: aa43477b0402 ("io_uring: poll rework")
Reported-by: Dylan Yudaken <dylany@xxxxxx>
Signed-off-by: Jens Axboe <axboe@xxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
fs/io_uring.c | 1 +
1 file changed, 1 insertion(+)
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -5870,6 +5870,7 @@ static __cold bool io_poll_remove_all(st
list = &ctx->cancel_hash[i];
hlist_for_each_entry_safe(req, tmp, list, hash_node) {
if (io_match_task_safe(req, tsk, cancel_all)) {
+ hlist_del_init(&req->hash_node);
io_poll_cancel_req(req);
found = true;
}
Patches currently in stable-queue which might be from axboe@xxxxxxxxx are
queue-5.17/block-fix-the-maximum-minor-value-is-blk_alloc_ext_minor.patch
queue-5.17/block-ensure-plug-merging-checks-the-correct-queue-at-least-once.patch
queue-5.17/block-don-t-merge-across-cgroup-boundaries-if-blkcg-is-enabled.patch
queue-5.17/block-limit-request-dispatch-loop-duration.patch
queue-5.17/block-bfq-don-t-move-oom_bfqq.patch
queue-5.17/block-don-t-delete-queue-kobject-before-its-children.patch
queue-5.17/io_uring-bump-poll-refs-to-full-31-bits.patch
queue-5.17/io_uring-fix-memory-leak-of-uid-in-files-registration.patch
queue-5.17/block-throttle-split-bio-in-case-of-iops-limit.patch
queue-5.17/loop-fix-ioctl-calls-using-compat_loop_info.patch
queue-5.17/bfq-fix-use-after-free-in-bfq_dispatch_request.patch
queue-5.17/block-flush-plug-based-on-hardware-and-software-queue-order.patch
queue-5.17/block-restore-the-old-set_task_ioprio-behaviour-wrt-pf_exiting.patch
queue-5.17/io_uring-terminate-manual-loop-iterator-loop-correct.patch
queue-5.17/memstick-mspro_block-fix-handling-of-read-only-devic.patch
queue-5.17/block-bfq_wf2q-correct-weight-to-ioprio.patch
queue-5.17/loop-use-sysfs_emit-in-the-sysfs-xxx-show.patch
queue-5.17/revert-revert-block-bfq-honor-already-setup-queue-me.patch
queue-5.17/block-update-io_ticks-when-io-hang.patch
queue-5.17/drbd-fix-potential-silent-data-corruption.patch
queue-5.17/io_uring-remove-poll-entry-from-list-when-canceling-all.patch
queue-5.17/blk-cgroup-set-blkg-iostat-after-percpu-stat-aggrega.patch
queue-5.17/block-fix-rq-qos-breakage-from-skipping-rq_qos_done_bio.patch
queue-5.17/io_uring-ensure-that-fsnotify-is-always-called.patch
queue-5.17/io_uring-don-t-check-unrelated-req-open.how-in-accep.patch
