io_uring/rsrc: fix rogue rsrc node grabbing

[platform/kernel/linux-starfive.git] / io_uring / io-wq.c

diff --git a/io_uring/io-wq.c b/io_uring/io-wq.c
index 411bb2d..f81c0a7 100644 (file)
--- a/io_uring/io-wq.c
+++ b/io_uring/io-wq.c
@@ -616,7 +616,7 @@ static int io_wqe_worker(void *data)
        struct io_wqe_acct *acct = io_wqe_get_acct(worker);
        struct io_wqe *wqe = worker->wqe;
        struct io_wq *wq = wqe->wq;
-       bool last_timeout = false;
+       bool exit_mask = false, last_timeout = false;
        char buf[TASK_COMM_LEN];
 
        worker->flags |= (IO_WORKER_F_UP | IO_WORKER_F_RUNNING);
@@ -632,8 +632,11 @@ static int io_wqe_worker(void *data)
                        io_worker_handle_work(worker);
 
                raw_spin_lock(&wqe->lock);
-               /* timed out, exit unless we're the last worker */
-               if (last_timeout && acct->nr_workers > 1) {
+               /*
+                * Last sleep timed out. Exit if we're not the last worker,
+                * or if someone modified our affinity.
+                */
+               if (last_timeout && (exit_mask || acct->nr_workers > 1)) {
                        acct->nr_workers--;
                        raw_spin_unlock(&wqe->lock);
                        __set_current_state(TASK_RUNNING);
@@ -652,7 +655,11 @@ static int io_wqe_worker(void *data)
                                continue;
                        break;
                }
-               last_timeout = !ret;
+               if (!ret) {
+                       last_timeout = true;
+                       exit_mask = !cpumask_test_cpu(raw_smp_processor_id(),
+                                                       wqe->cpu_mask);
+               }
        }
 
        if (test_bit(IO_WQ_BIT_EXIT, &wq->state))
@@ -704,7 +711,6 @@ static void io_init_new_worker(struct io_wqe *wqe, struct io_worker *worker,
        tsk->worker_private = worker;
        worker->task = tsk;
        set_cpus_allowed_ptr(tsk, wqe->cpu_mask);
-       tsk->flags |= PF_NO_SETAFFINITY;
 
        raw_spin_lock(&wqe->lock);
        hlist_nulls_add_head_rcu(&worker->nulls_node, &wqe->free_list);