This is a note to let you know that I've just added the patch titled
io_uring: fix drain stalls by invalid SQE
to the 6.5-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
io_uring-fix-drain-stalls-by-invalid-sqe.patch
and it can be found in the queue-6.5 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
commit 2393acebd1eef80b87a23af873886fd87d744234
Author: Pavel Begunkov <asml.silence@xxxxxxxxx>
Date: Wed Aug 9 13:21:41 2023 +0100
io_uring: fix drain stalls by invalid SQE
[ Upstream commit cfdbaa3a291d6fd2cb4a1a70d74e63b4abc2f5ec ]
cq_extra is protected by ->completion_lock, which io_get_sqe() misses.
The bug is harmless as it doesn't happen in real life, requires invalid
SQ index array and racing with submission, and only messes up the
userspace, i.e. stall requests execution but will be cleaned up on
ring destruction.
Fixes: 15641e427070f ("io_uring: don't cache number of dropped SQEs")
Signed-off-by: Pavel Begunkov <asml.silence@xxxxxxxxx>
Link: https://lore.kernel.org/r/66096d54651b1a60534bb2023f2947f09f50ef73.1691538547.git.asml.silence@xxxxxxxxx
Signed-off-by: Jens Axboe <axboe@xxxxxxxxx>
Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>
diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index 93db3e4e7b688..41c0b24db0c0f 100644
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -2382,7 +2382,9 @@ static bool io_get_sqe(struct io_ring_ctx *ctx, const struct io_uring_sqe **sqe)
}
/* drop invalid entries */
+ spin_lock(&ctx->completion_lock);
ctx->cq_extra--;
+ spin_unlock(&ctx->completion_lock);
WRITE_ONCE(ctx->rings->sq_dropped,
READ_ONCE(ctx->rings->sq_dropped) + 1);
return false;
