github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-28 09:04:39 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

io_uring: hold uring_lock when walking link chain in io_wq_free_work()

Browse Source 
io_wq_free_work() calls io_req_find_next() from io-wq worker context,
which reads and clears req->link without holding any lock. This can
potentially race with other paths that mutate the same chain under
ctx->uring_lock.

Take ctx->uring_lock around the io_req_find_next() call. Only requests
with IO_REQ_LINK_FLAGS reach this path, which is not the hot path.

Signed-off-by: Jens Axboe <axboe@kernel.dk>
This commit is contained in:
Jens Axboe 2026-05-11 10:58:38 -06:00
parent 3799c25709
commit 20c39819a2
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
io_uring/io_uring.c
View File

@ -1452,8 +1452,13 @@ struct io_wq_work *io_wq_free_work(struct io_wq_work *work)
struct io_kiocb *nxt = NULL;
if (req_ref_put_and_test_atomic(req)) {
if (req->flags & IO_REQ_LINK_FLAGS)
if (req->flags & IO_REQ_LINK_FLAGS) {
struct io_ring_ctx *ctx = req->ctx;
mutex_lock(&ctx->uring_lock);
nxt = io_req_find_next(req);
mutex_unlock(&ctx->uring_lock);
}
io_free_req(req);
}
return nxt ? &nxt->work : NULL;