diff options
| author | Jens Axboe <axboe@kernel.dk> | 2022-03-21 19:03:24 -0600 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2022-03-21 19:03:24 -0600 |
| commit | 61bc84c4008812d784c398cfb54118c1ba396dfc (patch) | |
| tree | 7f96500cac4217995f120dbc129f2ea2145a87bb /fs | |
| parent | 649bb75d19c93f5459f450191953dff4825fda3e (diff) | |
| download | linux-61bc84c4008812d784c398cfb54118c1ba396dfc.tar.gz linux-61bc84c4008812d784c398cfb54118c1ba396dfc.tar.bz2 linux-61bc84c4008812d784c398cfb54118c1ba396dfc.zip | |
io_uring: remove poll entry from list when canceling all
When the ring is exiting, as part of the shutdown, poll requests are
removed. But io_poll_remove_all() does not remove entries when finding
them, and since completions are done out-of-band, we can find and remove
the same entry multiple times.
We do guard the poll execution by poll ownership, but that does not
exclude us from reissuing a new one once the previous removal ownership
goes away.
This can race with poll execution as well, where we then end up seeing
req->apoll be NULL because a previous task_work requeue finished the
request.
Remove the poll entry when we find it and get ownership of it. This
prevents multiple invocations from finding it.
Fixes: aa43477b0402 ("io_uring: poll rework")
Reported-by: Dylan Yudaken <dylany@fb.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/io_uring.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/fs/io_uring.c b/fs/io_uring.c index 48f4540d7dd5..53bd71363a44 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -6275,6 +6275,7 @@ static __cold bool io_poll_remove_all(struct io_ring_ctx *ctx, list = &ctx->cancel_hash[i]; hlist_for_each_entry_safe(req, tmp, list, hash_node) { if (io_match_task_safe(req, tsk, cancel_all)) { + hlist_del_init(&req->hash_node); io_poll_cancel_req(req); found = true; } |