Pavel Begunkov 0c323430e4 io_uring: fix drain stalls by invalid SQE ... [ Upstream commit cfdbaa3a29 ] cq_extra is protected by ->completion_lock, which io_get_sqe() misses. The bug is harmless as it doesn't happen in real life, requires invalid SQ index array and racing with submission, and only messes up the userspace, i.e. stall requests execution but will be cleaned up on ring destruction. Fixes: 15641e4270 ("io_uring: don't cache number of dropped SQEs") Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Link: https://lore.kernel.org/r/66096d54651b1a60534bb2023f2947f09f50ef73.1691538547.git.asml.silence@gmail.com Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Sasha Levin <sashal@kernel.org>		2023-09-13 09:42:43 +02:00
..
Makefile	…
advise.c	…
advise.h	…
alloc_cache.h	…
cancel.c	…
cancel.h	…
epoll.c	…
epoll.h	…
fdinfo.c	…
fdinfo.h	…
filetable.c	…
filetable.h	…
fs.c	…
fs.h	…
io-wq.c	…
io-wq.h	…
io_uring.c	io_uring: fix drain stalls by invalid SQE	2023-09-13 09:42:43 +02:00
io_uring.h	…
kbuf.c	…
kbuf.h	…
msg_ring.c	io_uring/msg_ring: fix missing lock on overflow for IOPOLL	2023-08-30 16:11:05 +02:00
msg_ring.h	io_uring: get rid of double locking	2023-08-30 16:11:04 +02:00
net.c	…
net.h	…
nop.c	…
nop.h	…
notif.c	…
notif.h	…
opdef.c	io_uring: get rid of double locking	2023-08-30 16:11:04 +02:00
opdef.h	…
openclose.c	io_uring: correct check for O_TMPFILE	2023-08-16 18:27:24 +02:00
openclose.h	…
poll.c	…
poll.h	…
refs.h	…
rsrc.c	…
rsrc.h	…
rw.c	…
rw.h	…
slist.h	…
splice.c	…
splice.h	…
sqpoll.c	…
sqpoll.h	…
statx.c	…
statx.h	…
sync.c	…
sync.h	…
tctx.c	…
tctx.h	…
timeout.c	io_uring: annotate offset timeout races	2023-08-11 12:08:24 +02:00
timeout.h	…
uring_cmd.c	…
uring_cmd.h	…
xattr.c	…
xattr.h	…