diff options
| author | Ming Lei <ming.lei@redhat.com> | 2025-04-25 09:37:40 +0800 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2025-04-24 19:52:20 -0600 |
| commit | f40139fde5278d81af3227444fd6e76a76b9506d (patch) | |
| tree | ee9f4a08af52c19113189b707fd0ad80c72426d5 /net/lapb/lapb_iface.c | |
| parent | d6aa0c178bf81f30ae4a780b2bca653daa2eb633 (diff) | |
| download | linux-f40139fde5278d81af3227444fd6e76a76b9506d.tar.gz linux-f40139fde5278d81af3227444fd6e76a76b9506d.tar.bz2 linux-f40139fde5278d81af3227444fd6e76a76b9506d.zip | |
ublk: fix race between io_uring_cmd_complete_in_task and ublk_cancel_cmd
ublk_cancel_cmd() calls io_uring_cmd_done() to complete uring_cmd, but
we may have scheduled task work via io_uring_cmd_complete_in_task() for
dispatching request, then kernel crash can be triggered.
Fix it by not trying to canceling the command if ublk block request is
started.
Fixes: 216c8f5ef0f2 ("ublk: replace monitor with cancelable uring_cmd")
Reported-by: Jared Holzman <jholzman@nvidia.com>
Tested-by: Jared Holzman <jholzman@nvidia.com>
Closes: https://lore.kernel.org/linux-block/d2179120-171b-47ba-b664-23242981ef19@nvidia.com/
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Link: https://lore.kernel.org/r/20250425013742.1079549-3-ming.lei@redhat.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'net/lapb/lapb_iface.c')
0 files changed, 0 insertions, 0 deletions