Commit 20c39819 authored by Jens Axboe's avatar Jens Axboe
Browse files

io_uring: hold uring_lock when walking link chain in io_wq_free_work() 



io_wq_free_work() calls io_req_find_next() from io-wq worker context,
which reads and clears req->link without holding any lock. This can
potentially race with other paths that mutate the same chain under
ctx->uring_lock.

Take ctx->uring_lock around the io_req_find_next() call. Only requests
with IO_REQ_LINK_FLAGS reach this path, which is not the hot path.

Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 3799c257

io_uring/io_uring.c

+6 −1
Original line number Diff line number Diff line
@@ -1452,8 +1452,13 @@ struct io_wq_work *io_wq_free_work(struct io_wq_work *work) 
	struct io_kiocb *nxt = NULL;



	if (req_ref_put_and_test_atomic(req)) {

		if (req->flags & IO_REQ_LINK_FLAGS)

		if (req->flags & IO_REQ_LINK_FLAGS) {

			struct io_ring_ctx *ctx = req->ctx;



			mutex_lock(&ctx->uring_lock);

			nxt = io_req_find_next(req);

			mutex_unlock(&ctx->uring_lock);

		}

		io_free_req(req);

	}

	return nxt ? &nxt->work : NULL;