diff options
| author | Pavel Begunkov <asml.silence@gmail.com> | 2024-12-28 17:44:52 +0000 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-01-09 13:33:51 +0100 |
| commit | 41ce61328e0f61dca96f42694aa96599c66e6ec1 (patch) | |
| tree | 12368230b29cd3200d977d088152750e1cbaee9d | |
| parent | 2297890b778b0e7c8200d6818154f7e461d78e94 (diff) | |
io_uring/rw: fix downgraded mshot read
commit 38fc96a58ce40257aec79b32e9b310c86907c63c upstream.
The io-wq path can downgrade a multishot request to oneshot mode,
however io_read_mshot() doesn't handle that and would still post
multiple CQEs. That's not allowed, because io_req_post_cqe() requires
stricter context requirements.
The described can only happen with pollable files that don't support
FMODE_NOWAIT, which is an odd combination, so if even allowed it should
be fairly rare.
Cc: stable@vger.kernel.org
Reported-by: chase xd <sl1589472800@gmail.com>
Fixes: bee1d5becdf5b ("io_uring: disable io-wq execution of multishot NOWAIT requests")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/c5c8c4a50a882fd581257b81bf52eee260ac29fd.1735407848.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | io_uring/rw.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/io_uring/rw.c b/io_uring/rw.c index 155938f10093..39ad25d16ed4 100644 --- a/io_uring/rw.c +++ b/io_uring/rw.c @@ -979,6 +979,8 @@ int io_read_mshot(struct io_kiocb *req, unsigned int issue_flags) io_kbuf_recycle(req, issue_flags); if (ret < 0) req_set_fail(req); + } else if (!(req->flags & REQ_F_APOLL_MULTISHOT)) { + cflags = io_put_kbuf(req, ret, issue_flags); } else { /* * Any successful return value will keep the multishot read |