Reference in a new issue

Blame

Copy permalink

Reference in a new issue

Copy permalink

Runyu Xiao d179533c61 io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item ... commit 29bef9934b upstream. commit 10dc959398 ("io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop") fixed the obvious case where io_worker_handle_work() took one exit-bit snapshot before draining pending work, but the fix stops one level too early. io_worker_handle_work() now re-checks IO_WQ_BIT_EXIT in its outer work run loop, yet it still snapshots that bit once before processing a whole dependent linked-work chain. If io_wq_exit_start() sets IO_WQ_BIT_EXIT after the first linked item has started, the remaining linked items can still reuse stale do_kill = false, skip IO_WQ_WORK_CANCEL, and continue running after exit has begun. Move the check further inside, so it covers linked items too. Note: this is a syzbot special as it loves setting up tons of slow linked work on weird devices like msr that take forever to read, and immediately close the ring. Exit then takes a long time. Fixes: 10dc959398 ("io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop") Cc: stable@vger.kernel.org Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn> Link: https://patch.msgid.link/20260527172203.2043962-1-runyu.xiao@seu.edu.cn Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		History 2026-07-24 15:51:21 +02:00
..
io-wq.c	io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item	2026-07-24 15:51:21 +02:00
io-wq.h	io_uring: break out of iowq iopoll on teardown	2023-09-19 12:22:54 +02:00
io_uring.c	io_uring/poll: fix signed comparison in io_poll_get_ownership()	2026-06-19 13:33:39 +02:00
Makefile	io_uring: move to separate directory	2022-12-14 11:37:31 +01:00