public-mirrors/linux
1
0
Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-08-05 16:54:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

io_uring: ensure poll commands clear ->sqe

Browse source 
If we end up getting woken in poll (due to a signal), then we may need
to punt the poll request to an async worker. When we do that, we look up
the list to queue at, deferefencing req->submit.sqe, however that is
only set for requests we initially decided to queue async.

This fixes a crash with poll command usage and wakeups that need to punt
to async context.

Fixes: 54a91f3bb9 ("io_uring: limit parallelism of buffered writes")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
This commit is contained in:
Jens Axboe 2019-09-18 11:18:23 -06:00
parent 5f5ad9ced3
commit 6cc47d1d2a
1 changed files with 9 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
fs/io_uring.c
View file

@ -446,16 +446,15 @@ static void __io_commit_cqring(struct io_ring_ctx *ctx)
static inline void io_queue_async_work(struct io_ring_ctx *ctx, static inline void io_queue_async_work(struct io_ring_ctx *ctx,
struct io_kiocb *req) struct io_kiocb *req)
{ {
int rw; int rw = 0;
switch (req->submit.sqe->opcode) { if (req->submit.sqe) {
case IORING_OP_WRITEV: switch (req->submit.sqe->opcode) {
case IORING_OP_WRITE_FIXED: case IORING_OP_WRITEV:
rw = !(req->rw.ki_flags & IOCB_DIRECT); case IORING_OP_WRITE_FIXED:
break; rw = !(req->rw.ki_flags & IOCB_DIRECT);
default: break;
rw = 0; }
break;
} }
queue_work(ctx->sqo_wq[rw], &req->work); queue_work(ctx->sqo_wq[rw], &req->work);
@ -1714,6 +1713,7 @@ static int io_poll_add(struct io_kiocb *req, const struct io_uring_sqe *sqe)
if (!poll->file) if (!poll->file)
return -EBADF; return -EBADF;
req->submit.sqe = NULL;
INIT_WORK(&req->work, io_poll_complete_work); INIT_WORK(&req->work, io_poll_complete_work);
events = READ_ONCE(sqe->poll_events); events = READ_ONCE(sqe->poll_events);
poll->events = demangle_poll(events) | EPOLLERR | EPOLLHUP; poll->events = demangle_poll(events) | EPOLLERR | EPOLLHUP;