mirror of
https://github.com/Fishwaldo/Star64_linux.git
synced 2025-03-16 12:14:06 +00:00
io_uring: fix drain stalls by invalid SQE
cq_extra is protected by ->completion_lock, which io_get_sqe() misses.
The bug is harmless as it doesn't happen in real life, requires invalid
SQ index array and racing with submission, and only messes up the
userspace, i.e. stall requests execution but will be cleaned up on
ring destruction.
Fixes: 15641e4270
("io_uring: don't cache number of dropped SQEs")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/66096d54651b1a60534bb2023f2947f09f50ef73.1691538547.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
This commit is contained in:
parent
d4b30eed51
commit
cfdbaa3a29
1 changed files with 2 additions and 0 deletions
|
@ -2374,7 +2374,9 @@ static bool io_get_sqe(struct io_ring_ctx *ctx, const struct io_uring_sqe **sqe)
|
|||
}
|
||||
|
||||
/* drop invalid entries */
|
||||
spin_lock(&ctx->completion_lock);
|
||||
ctx->cq_extra--;
|
||||
spin_unlock(&ctx->completion_lock);
|
||||
WRITE_ONCE(ctx->rings->sq_dropped,
|
||||
READ_ONCE(ctx->rings->sq_dropped) + 1);
|
||||
return false;
|
||||
|
|
Loading…
Add table
Reference in a new issue