Patch "io_uring: fix drain stalls by invalid SQE" has been added to the 6.1-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    io_uring: fix drain stalls by invalid SQE

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     io_uring-fix-drain-stalls-by-invalid-sqe.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 04c56e521099f5825b966c96ac876411838846fc
Author: Pavel Begunkov <asml.silence@xxxxxxxxx>
Date:   Wed Aug 9 13:21:41 2023 +0100

    io_uring: fix drain stalls by invalid SQE
    
    [ Upstream commit cfdbaa3a291d6fd2cb4a1a70d74e63b4abc2f5ec ]
    
    cq_extra is protected by ->completion_lock, which io_get_sqe() misses.
    The bug is harmless as it doesn't happen in real life, requires invalid
    SQ index array and racing with submission, and only messes up the
    userspace, i.e. stall requests execution but will be cleaned up on
    ring destruction.
    
    Fixes: 15641e427070f ("io_uring: don't cache number of dropped SQEs")
    Signed-off-by: Pavel Begunkov <asml.silence@xxxxxxxxx>
    Link: https://lore.kernel.org/r/66096d54651b1a60534bb2023f2947f09f50ef73.1691538547.git.asml.silence@xxxxxxxxx
    Signed-off-by: Jens Axboe <axboe@xxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index b0e47fe1eb4bb..e15abe26a0e61 100644
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -2240,7 +2240,9 @@ static const struct io_uring_sqe *io_get_sqe(struct io_ring_ctx *ctx)
 	}
 
 	/* drop invalid entries */
+	spin_lock(&ctx->completion_lock);
 	ctx->cq_extra--;
+	spin_unlock(&ctx->completion_lock);
 	WRITE_ONCE(ctx->rings->sq_dropped,
 		   READ_ONCE(ctx->rings->sq_dropped) + 1);
 	return NULL;



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux