mirror of https://github.com/torvalds/linux.git
390513642e
io_uring always switches requests to atomic refcounting for iowq execution before there is any parallilism by setting REQ_F_REFCOUNT, and the flag is not cleared until the request completes. That should be fine as long as the compiler doesn't make up a non existing value for the flags, however KCSAN still complains when the request owner changes oter flag bits: BUG: KCSAN: data-race in io_req_task_cancel / io_wq_free_work ... read to 0xffff888117207448 of 8 bytes by task 3871 on cpu 0: req_ref_put_and_test io_uring/refs.h:22 [inline] Skip REQ_F_REFCOUNT checks for iowq, we know it's set. Reported-by: syzbot+903a2ad71fb3f1e47cf5@syzkaller.appspotmail.com Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Link: https://lore.kernel.org/r/d880bc27fb8c3209b54641be4ff6ac02b0e5789a.1743679736.git.asml.silence@gmail.com Signed-off-by: Jens Axboe <axboe@kernel.dk> |
||
|---|---|---|
| .. | ||
| Kconfig | ||
| Makefile | ||
| advise.c | ||
| advise.h | ||
| alloc_cache.c | ||
| alloc_cache.h | ||
| cancel.c | ||
| cancel.h | ||
| epoll.c | ||
| epoll.h | ||
| eventfd.c | ||
| eventfd.h | ||
| fdinfo.c | ||
| fdinfo.h | ||
| filetable.c | ||
| filetable.h | ||
| fs.c | ||
| fs.h | ||
| futex.c | ||
| futex.h | ||
| io-wq.c | ||
| io-wq.h | ||
| io_uring.c | ||
| io_uring.h | ||
| kbuf.c | ||
| kbuf.h | ||
| memmap.c | ||
| memmap.h | ||
| msg_ring.c | ||
| msg_ring.h | ||
| napi.c | ||
| napi.h | ||
| net.c | ||
| net.h | ||
| nop.c | ||
| nop.h | ||
| notif.c | ||
| notif.h | ||
| opdef.c | ||
| opdef.h | ||
| openclose.c | ||
| openclose.h | ||
| poll.c | ||
| poll.h | ||
| refs.h | ||
| register.c | ||
| register.h | ||
| rsrc.c | ||
| rsrc.h | ||
| rw.c | ||
| rw.h | ||
| slist.h | ||
| splice.c | ||
| splice.h | ||
| sqpoll.c | ||
| sqpoll.h | ||
| statx.c | ||
| statx.h | ||
| sync.c | ||
| sync.h | ||
| tctx.c | ||
| tctx.h | ||
| timeout.c | ||
| timeout.h | ||
| truncate.c | ||
| truncate.h | ||
| uring_cmd.c | ||
| uring_cmd.h | ||
| waitid.c | ||
| waitid.h | ||
| xattr.c | ||
| xattr.h | ||
| zcrx.c | ||
| zcrx.h | ||