From be9bc79296726ed38eee93f314419fe1bf1c0411 Mon Sep 17 00:00:00 2001 From: Jens Axboe Date: Fri, 16 Jun 2023 21:12:06 -0600 Subject: [PATCH] UPSTREAM: io_uring: hold uring mutex around poll removal Snipped from commit 9ca9fb24d5febccea354089c41f96a8ad0d853f8 upstream. While reworking the poll hashing in the v6.0 kernel, we ended up grabbing the ctx->uring_lock in poll update/removal. This also fixed a bug with linked timeouts racing with timeout expiry and poll removal. Bring back just the locking fix for that. Bug: 289229683 Reported-and-tested-by: Querijn Voet Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman (cherry picked from commit 0e388fce7aec40992eadee654193cad345d62663) Signed-off-by: Lee Jones Change-Id: Ife3683f26b19af1887ae1c59d3bd8b4e1700c79a --- io_uring/io_uring.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c index 5325e915a5d7..419a64990906 100644 --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -5976,6 +5976,8 @@ static int io_poll_update(struct io_kiocb *req, unsigned int issue_flags) struct io_kiocb *preq; int ret2, ret = 0; + io_ring_submit_lock(ctx, !(issue_flags & IO_URING_F_NONBLOCK)); + spin_lock(&ctx->completion_lock); preq = io_poll_find(ctx, req->poll_update.old_user_data, true); if (!preq || !io_poll_disarm(preq)) { @@ -6007,6 +6009,7 @@ out: req_set_fail(req); /* complete update request, we're done with it */ io_req_complete(req, ret); + io_ring_submit_unlock(ctx, !(issue_flags & IO_URING_F_NONBLOCK)); return 0; }