public inbox for [email protected]
 help / color / mirror / Atom feed
* [PATCH for-next] io_uring: fix io_free_batch_list races
@ 2021-10-12 14:02 Pavel Begunkov
  2021-10-12 14:59 ` Jens Axboe
  0 siblings, 1 reply; 2+ messages in thread
From: Pavel Begunkov @ 2021-10-12 14:02 UTC (permalink / raw)
  To: io-uring; +Cc: Jens Axboe, asml.silence

[  158.514382] WARNING: CPU: 5 PID: 15251 at fs/io_uring.c:1141 io_free_batch_list+0x269/0x360
[  158.514426] RIP: 0010:io_free_batch_list+0x269/0x360
[  158.514437] Call Trace:
[  158.514440]  __io_submit_flush_completions+0xde/0x180
[  158.514444]  tctx_task_work+0x14a/0x220
[  158.514447]  task_work_run+0x64/0xa0
[  158.514448]  __do_sys_io_uring_enter+0x7c/0x970
[  158.514450]  __x64_sys_io_uring_enter+0x22/0x30
[  158.514451]  do_syscall_64+0x43/0x90
[  158.514453]  entry_SYSCALL_64_after_hwframe+0x44/0xae

We should not touch request internals including req->comp_list.next
after putting our ref if it's not final, e.g. we can start freeing
requests from the free cache.

Fixed: 62ca9cb93e7f8 ("io_uring: optimise io_free_batch_list()")
Signed-off-by: Pavel Begunkov <[email protected]>
---
 fs/io_uring.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 73135c5c6168..55435464cee0 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -2266,9 +2266,10 @@ static void io_free_batch_list(struct io_ring_ctx *ctx,
 		struct io_kiocb *req = container_of(node, struct io_kiocb,
 						    comp_list);
 
-		if (!req_ref_put_and_test(req)) {
+		if (unlikely(req->flags & REQ_F_REFCOUNT)) {
 			node = req->comp_list.next;
-			continue;
+			if (!req_ref_put_and_test(req))
+				continue;
 		}
 
 		io_queue_next(req);
-- 
2.33.0


^ permalink raw reply related	[flat|nested] 2+ messages in thread

* Re: [PATCH for-next] io_uring: fix io_free_batch_list races
  2021-10-12 14:02 [PATCH for-next] io_uring: fix io_free_batch_list races Pavel Begunkov
@ 2021-10-12 14:59 ` Jens Axboe
  0 siblings, 0 replies; 2+ messages in thread
From: Jens Axboe @ 2021-10-12 14:59 UTC (permalink / raw)
  To: Pavel Begunkov, io-uring

On 10/12/21 8:02 AM, Pavel Begunkov wrote:
> [  158.514382] WARNING: CPU: 5 PID: 15251 at fs/io_uring.c:1141 io_free_batch_list+0x269/0x360
> [  158.514426] RIP: 0010:io_free_batch_list+0x269/0x360
> [  158.514437] Call Trace:
> [  158.514440]  __io_submit_flush_completions+0xde/0x180
> [  158.514444]  tctx_task_work+0x14a/0x220
> [  158.514447]  task_work_run+0x64/0xa0
> [  158.514448]  __do_sys_io_uring_enter+0x7c/0x970
> [  158.514450]  __x64_sys_io_uring_enter+0x22/0x30
> [  158.514451]  do_syscall_64+0x43/0x90
> [  158.514453]  entry_SYSCALL_64_after_hwframe+0x44/0xae
> 
> We should not touch request internals including req->comp_list.next
> after putting our ref if it's not final, e.g. we can start freeing
> requests from the free cache.

Applied, thanks.

-- 
Jens Axboe


^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2021-10-12 14:59 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2021-10-12 14:02 [PATCH for-next] io_uring: fix io_free_batch_list races Pavel Begunkov
2021-10-12 14:59 ` Jens Axboe

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox