diff options
| author | Pavel Begunkov <[email protected]> | 2020-11-25 18:41:28 +0000 |
|---|---|---|
| committer | Jens Axboe <[email protected]> | 2020-11-26 15:50:21 +0000 |
| commit | af60470347de6ac2b9f0cc3703975a543a3de075 (patch) | |
| tree | 6b0d7677d948ebb14a02c02fca16c9f63d6644cb /net/switchdev/switchdev.c | |
| parent | io_uring: fix ITER_BVEC check (diff) | |
| download | kernel-af60470347de6ac2b9f0cc3703975a543a3de075.tar.gz kernel-af60470347de6ac2b9f0cc3703975a543a3de075.zip | |
io_uring: fix files grab/cancel race
When one task is in io_uring_cancel_files() and another is doing
io_prep_async_work() a race may happen. That's because after accounting
a request inflight in first call to io_grab_identity() it still may fail
and go to io_identity_cow(), which migh briefly keep dangling
work.identity and not only.
Grab files last, so io_prep_async_work() won't fail if it did get into
->inflight_list.
note: the bug shouldn't exist after making io_uring_cancel_files() not
poking into other tasks' requests.
Signed-off-by: Pavel Begunkov <[email protected]>
Signed-off-by: Jens Axboe <[email protected]>
Diffstat (limited to 'net/switchdev/switchdev.c')
0 files changed, 0 insertions, 0 deletions