| Message ID | 63312b4a2c2bb67ad67b857d17a300e1d3b078e8.1734637909.git.asml.silence@gmail.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | [1/1] io_uring: check if iowq is kileed before queuing | expand |
On Thu, 19 Dec 2024 19:52:58 +0000, Pavel Begunkov wrote: > task works can be executed after the task has gone through io_uring > termination, whether it's the final task_work run or the fallback path. > In this case, task work will fined ->io_wq being already killed and > null'ed, which is a problem if it then tries to forward the request to > io_queue_iowq(). Make io_queue_iowq() to fail requests in this case. > > Note that it also checks PF_KTHREAD, because the user can first close > a DEFER_TASKRUN ring and shortly after kill the task, in which case > ->iowq check would race. > > [...] Applied, thanks! [1/1] io_uring: check if iowq is kileed before queuing commit: dbd2ca9367eb19bc5e269b8c58b0b1514ada9156 Best regards,
diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c index 5535a72b0ce1..8353a113bcc0 100644 --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -514,7 +514,11 @@ static void io_queue_iowq(struct io_kiocb *req) struct io_uring_task *tctx = req->tctx; BUG_ON(!tctx); - BUG_ON(!tctx->io_wq); + + if ((current->flags & PF_KTHREAD) || !tctx->io_wq) { + io_req_task_queue_fail(req, -ECANCELED); + return; + } /* init ->work of the whole link before punting */ io_prep_async_link(req);
task works can be executed after the task has gone through io_uring termination, whether it's the final task_work run or the fallback path. In this case, task work will fined ->io_wq being already killed and null'ed, which is a problem if it then tries to forward the request to io_queue_iowq(). Make io_queue_iowq() to fail requests in this case. Note that it also checks PF_KTHREAD, because the user can first close a DEFER_TASKRUN ring and shortly after kill the task, in which case ->iowq check would race. Cc: stable@vger.kernel.org Fixes: 50c52250e2d74 ("block: implement async io_uring discard cmd") Fixes: 773af69121ecc ("io_uring: always reissue from task_work context") Reported-by: Will <willsroot@protonmail.com> Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> --- io_uring/io_uring.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)