lkml.org 
[lkml]   [2020]   [Mar]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.5 039/119] io_uring: fix lockup with timeouts
    Date
    From: Pavel Begunkov <asml.silence@gmail.com>

    [ Upstream commit f0e20b8943509d81200cef5e30af2adfddba0f5c ]

    There is a recipe to deadlock the kernel: submit a timeout sqe with a
    linked_timeout (e.g. test_single_link_timeout_ception() from liburing),
    and SIGKILL the process.

    Then, io_kill_timeouts() takes @ctx->completion_lock, but the timeout
    isn't flagged with REQ_F_COMP_LOCKED, and will try to double grab it
    during io_put_free() to cancel the linked timeout. Probably, the same
    can happen with another io_kill_timeout() call site, that is
    io_commit_cqring().

    Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
    Signed-off-by: Jens Axboe <axboe@kernel.dk>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    fs/io_uring.c | 1 +
    1 file changed, 1 insertion(+)

    diff --git a/fs/io_uring.c b/fs/io_uring.c
    index 2547c6395d5e4..44ae2641b4b06 100644
    --- a/fs/io_uring.c
    +++ b/fs/io_uring.c
    @@ -688,6 +688,7 @@ static void io_kill_timeout(struct io_kiocb *req)
    if (ret != -1) {
    atomic_inc(&req->ctx->cq_timeouts);
    list_del_init(&req->list);
    + req->flags |= REQ_F_COMP_LOCKED;
    io_cqring_fill_event(req, 0);
    io_put_req(req);
    }
    --
    2.20.1


    \
     
     \ /
      Last update: 2020-03-24 14:23    [W:4.696 / U:0.044 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site