GitHub-Mirror/Star64_linux
2
0
Fork 0
mirror of https://github.com/Fishwaldo/Star64_linux.git synced 2025-04-01 12:04:08 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

io_uring: fix race around poll update and poll triggering

Browse source 
Joakim reports that in some conditions he sees a multishot poll request
being canceled, and that it coincides with getting -EALREADY on
modification. As part of the poll update procedure, there's a small window
where the request is marked as canceled, and if this coincides with the
event actually triggering, then we can get a spurious -ECANCELED and
termination of the multishot request.

Don't mark the poll request as being canceled for update. We also don't
care if we race on removal unless it's a one-shot request, we can safely
updated for either case.

Fixes: b69de288e9 ("io_uring: allow events and user_data update of running poll requests")
Reported-by: Joakim Hassila <joj@mac.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
This commit is contained in:
Jens Axboe 2021-03-31 09:03:03 -06:00
parent 50e96989d7
commit b2e720ace2
1 changed files with 10 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
fs/io_uring.c
View file

@ -5213,14 +5213,15 @@ static bool io_arm_poll_handler(struct io_kiocb *req)
} }
static bool __io_poll_remove_one(struct io_kiocb *req, static bool __io_poll_remove_one(struct io_kiocb *req,
struct io_poll_iocb *poll) struct io_poll_iocb *poll, bool do_cancel)
{ {
bool do_complete = false; bool do_complete = false;
if (!poll->head) if (!poll->head)
return false; return false;
spin_lock(&poll->head->lock); spin_lock(&poll->head->lock);
WRITE_ONCE(poll->canceled, true); if (do_cancel)
WRITE_ONCE(poll->canceled, true);
if (!list_empty(&poll->wait.entry)) { if (!list_empty(&poll->wait.entry)) {
list_del_init(&poll->wait.entry); list_del_init(&poll->wait.entry);
do_complete = true; do_complete = true;
@ -5237,12 +5238,12 @@ static bool io_poll_remove_waitqs(struct io_kiocb *req)
io_poll_remove_double(req); io_poll_remove_double(req);
if (req->opcode == IORING_OP_POLL_ADD) { if (req->opcode == IORING_OP_POLL_ADD) {
do_complete = __io_poll_remove_one(req, &req->poll); do_complete = __io_poll_remove_one(req, &req->poll, true);
} else { } else {
struct async_poll *apoll = req->apoll; struct async_poll *apoll = req->apoll;
/* non-poll requests have submit ref still */ /* non-poll requests have submit ref still */
do_complete = __io_poll_remove_one(req, &apoll->poll); do_complete = __io_poll_remove_one(req, &apoll->poll, true);
if (do_complete) { if (do_complete) {
io_put_req(req); io_put_req(req);
kfree(apoll->double_poll); kfree(apoll->double_poll);
@ -5451,10 +5452,11 @@ static int io_poll_update(struct io_kiocb *req)
ret = -EACCES; ret = -EACCES;
goto err; goto err;
} }
if (!__io_poll_remove_one(preq, &preq->poll)) { if (!__io_poll_remove_one(preq, &preq->poll, false)) {
/* in process of completing/removal */ if (preq->poll.events & EPOLLONESHOT) {
ret = -EALREADY; ret = -EALREADY;
goto err; goto err;
}
} }
/* we now have a detached poll request. reissue. */ /* we now have a detached poll request. reissue. */
ret = 0; ret = 0;