| Message ID | 20190419095746.22894-1-source@stbuehler.de (mailing list archive) |
|---|---|
| State | Accepted, archived |
| Headers | show |
| Series | [v1,1/3] io_uring: fix race condition reading SQ entries | expand |
diff --git a/fs/io_uring.c b/fs/io_uring.c index f65f85d89217..96863e4780b7 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -1739,7 +1739,8 @@ static bool io_get_sqring(struct io_ring_ctx *ctx, struct sqe_submit *s) head = ctx->cached_sq_head; /* See comment at the top of this file */ smp_rmb(); - if (head == READ_ONCE(ring->r.tail)) + /* make sure SQ entry isn't read before tail */ + if (head == smp_load_acquire(&ring->r.tail)) return false; head = READ_ONCE(ring->array[head & ctx->sq_mask]);
A read memory barrier is required between reading SQ tail and reading the actual data belonging to the SQ entry. Userspace needs a matching write barrier between writing SQ entries and updating SQ tail (using smp_store_release to update tail will do). Signed-off-by: Stefan Bühler <source@stbuehler.de> --- fs/io_uring.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)