diff options
author | Pavel Begunkov <asml.silence@gmail.com> | 2023-05-19 15:21:16 +0100 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2023-08-11 12:08:24 +0200 |
commit | 88b1958fb57dd99406fd9f4ba4c2daf5e01168b8 (patch) | |
tree | 037ab0026a12a2864a47b707328eb5e09ac37c90 /io_uring | |
parent | a78a8bcdc26de5ef3a0ee27c9c6c512e54a6051c (diff) | |
download | linux-88b1958fb57dd99406fd9f4ba4c2daf5e01168b8.tar.gz |
io_uring: annotate offset timeout races
commit 5498bf28d8f2bd63a46ad40f4427518615fb793f upstream. It's racy to read ->cached_cq_tail without taking proper measures (usually grabbing ->completion_lock) as timeout requests with CQE offsets do, however they have never had a good semantics for from when they start counting. Annotate racy reads with data_race(). Reported-by: syzbot+cb265db2f3f3468ef436@syzkaller.appspotmail.com Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Link: https://lore.kernel.org/r/4de3685e185832a92a572df2be2c735d2e21a83d.1684506056.git.asml.silence@gmail.com Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'io_uring')
-rw-r--r-- | io_uring/timeout.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/io_uring/timeout.c b/io_uring/timeout.c index 4c6a5666541c..b0cf05ebcbcc 100644 --- a/io_uring/timeout.c +++ b/io_uring/timeout.c @@ -545,7 +545,7 @@ int io_timeout(struct io_kiocb *req, unsigned int issue_flags) goto add; } - tail = ctx->cached_cq_tail - atomic_read(&ctx->cq_timeouts); + tail = data_race(ctx->cached_cq_tail) - atomic_read(&ctx->cq_timeouts); timeout->target_seq = tail + off; /* Update the last seq here in case io_flush_timeouts() hasn't. |