From: Pavel Begunkov Date: Tue, 12 Oct 2021 14:02:14 +0000 (+0100) Subject: io_uring: fix io_free_batch_list races X-Git-Tag: v6.6.17~9008^2~36 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=def77acf4396a850544b41623d7720ea3a2674a9;p=platform%2Fkernel%2Flinux-rpi.git io_uring: fix io_free_batch_list races [ 158.514382] WARNING: CPU: 5 PID: 15251 at fs/io_uring.c:1141 io_free_batch_list+0x269/0x360 [ 158.514426] RIP: 0010:io_free_batch_list+0x269/0x360 [ 158.514437] Call Trace: [ 158.514440] __io_submit_flush_completions+0xde/0x180 [ 158.514444] tctx_task_work+0x14a/0x220 [ 158.514447] task_work_run+0x64/0xa0 [ 158.514448] __do_sys_io_uring_enter+0x7c/0x970 [ 158.514450] __x64_sys_io_uring_enter+0x22/0x30 [ 158.514451] do_syscall_64+0x43/0x90 [ 158.514453] entry_SYSCALL_64_after_hwframe+0x44/0xae We should not touch request internals including req->comp_list.next after putting our ref if it's not final, e.g. we can start freeing requests from the free cache. Fixed: 62ca9cb93e7f8 ("io_uring: optimise io_free_batch_list()") Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/b1f4df38fbb8f111f52911a02fd418d0283a4e6f.1634047298.git.asml.silence@gmail.com Signed-off-by: Jens Axboe --- diff --git a/fs/io_uring.c b/fs/io_uring.c index 383b8f6..141bfe7 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -2266,9 +2266,10 @@ static void io_free_batch_list(struct io_ring_ctx *ctx, struct io_kiocb *req = container_of(node, struct io_kiocb, comp_list); - if (!req_ref_put_and_test(req)) { + if (unlikely(req->flags & REQ_F_REFCOUNT)) { node = req->comp_list.next; - continue; + if (!req_ref_put_and_test(req)) + continue; } io_queue_next(req);