mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-30 22:26:55 +00:00
io_uring: remove poll entry from list when canceling all
commit61bc84c400
upstream. When the ring is exiting, as part of the shutdown, poll requests are removed. But io_poll_remove_all() does not remove entries when finding them, and since completions are done out-of-band, we can find and remove the same entry multiple times. We do guard the poll execution by poll ownership, but that does not exclude us from reissuing a new one once the previous removal ownership goes away. This can race with poll execution as well, where we then end up seeing req->apoll be NULL because a previous task_work requeue finished the request. Remove the poll entry when we find it and get ownership of it. This prevents multiple invocations from finding it. Fixes:aa43477b04
("io_uring: poll rework") Reported-by: Dylan Yudaken <dylany@fb.com> Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
4ae4311131
commit
484989ad2a
1 changed files with 1 additions and 0 deletions
|
@ -5870,6 +5870,7 @@ static __cold bool io_poll_remove_all(struct io_ring_ctx *ctx,
|
|||
list = &ctx->cancel_hash[i];
|
||||
hlist_for_each_entry_safe(req, tmp, list, hash_node) {
|
||||
if (io_match_task_safe(req, tsk, cancel_all)) {
|
||||
hlist_del_init(&req->hash_node);
|
||||
io_poll_cancel_req(req);
|
||||
found = true;
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue