From 87ed28db7d25bd086a3a32e899bbf2f02624a006 Mon Sep 17 00:00:00 2001 From: Jens Axboe Date: Tue, 23 May 2023 08:24:31 -0600 Subject: [PATCH] UPSTREAM: io_uring: don't drop completion lock before timer is fully initialized No upstream commit exists for this patch. If we drop the lock right after adding it to the timeout list, then someone attempting to kill timeouts will find it in an indeterminate state. That means that cancelation could attempt to cancel and remove a timeout, and then io_timeout() proceeds to init and add the timer afterwards. Ensure the timeout request is fully setup before we drop the completion lock, which guards cancelation as well. Bug: 278721720 Reported-and-tested-by: Lee Jones Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman (cherry picked from commit 6de3014d4bd8ff3e7017614741f2dbb02bca9361) Signed-off-by: Lee Jones Change-Id: I6247b62e07825a0f06c7997d767dfc26fc4126e3 --- fs/io_uring.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/io_uring.c b/fs/io_uring.c index 8e8022e6eb6e..9a14f39bda0c 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -2076,12 +2076,12 @@ static int io_timeout(struct io_kiocb *req, const struct io_uring_sqe *sqe) req->sequence -= span; add: list_add(&req->list, entry); - spin_unlock_irq(&ctx->completion_lock); hrtimer_init(&req->timeout.timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL); req->timeout.timer.function = io_timeout_fn; hrtimer_start(&req->timeout.timer, timespec64_to_ktime(ts), HRTIMER_MODE_REL); + spin_unlock_irq(&ctx->completion_lock); return 0; }