]> git.proxmox.com Git - mirror_ubuntu-kernels.git/commitdiff
io_uring: fix fs cleanup on cqe overflow
authorPavel Begunkov <asml.silence@gmail.com>
Thu, 9 Apr 2020 05:17:59 +0000 (08:17 +0300)
committerJens Axboe <axboe@kernel.dk>
Thu, 9 Apr 2020 15:38:18 +0000 (09:38 -0600)
If completion queue overflow occurs, __io_cqring_fill_event() will
update req->cflags, which is in a union with req->work and happens to
be aliased to req->work.fs. Following io_free_req() ->
io_req_work_drop_env() may get a bunch of different problems (miscount
fs->users, segfault, etc) on cleaning @fs.

Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
fs/io_uring.c

index 21e1c69b9c438982fe4be6ac8b2e795e0ad3d136..be65eda059ac5d80621e8403fa718cb6d7617d17 100644 (file)
@@ -608,6 +608,7 @@ struct io_kiocb {
        };
 
        struct io_async_ctx             *io;
+       int                             cflags;
        bool                            needs_fixed_file;
        u8                              opcode;
 
@@ -638,7 +639,6 @@ struct io_kiocb {
                        struct callback_head    task_work;
                        struct hlist_node       hash_node;
                        struct async_poll       *apoll;
-                       int                     cflags;
                };
                struct io_wq_work       work;
        };