diff options
| author | Pavel Begunkov <asml.silence@gmail.com> | 2022-06-13 06:32:44 +0100 |
|---|---|---|
| committer | Pavel Begunkov <asml.silence@gmail.com> | 2022-06-13 09:53:07 +0100 |
| commit | b0380bf6dad4601d92025841e2b7a135d566c6e3 (patch) | |
| tree | e13709f00bfd244cca8707cd9475d8be2f697e23 /fs/io_uring.c | |
| parent | a7c41b4687f5902af70cd559806990930c8a307b (diff) | |
io_uring: fix races with file table unregister
Fixed file table quiesce might unlock ->uring_lock, potentially letting
new requests to be submitted, don't allow those requests to use the
table as they will race with unregistration.
Reported-and-tested-by: van fantasy <g1042620637@gmail.com>
Fixes: 05f3fb3c53975 ("io_uring: avoid ring quiesce for fixed file set unregister and update")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Diffstat (limited to 'fs/io_uring.c')
| -rw-r--r-- | fs/io_uring.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/fs/io_uring.c b/fs/io_uring.c index ed3416a7b2e9..00d266746916 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -9768,11 +9768,19 @@ static void __io_sqe_files_unregister(struct io_ring_ctx *ctx) static int io_sqe_files_unregister(struct io_ring_ctx *ctx) { + unsigned nr = ctx->nr_user_files; int ret; if (!ctx->file_data) return -ENXIO; + + /* + * Quiesce may unlock ->uring_lock, and while it's not held + * prevent new requests using the table. + */ + ctx->nr_user_files = 0; ret = io_rsrc_ref_quiesce(ctx->file_data, ctx); + ctx->nr_user_files = nr; if (!ret) __io_sqe_files_unregister(ctx); return ret; |