From: Jens Axboe Date: Tue, 23 May 2023 14:24:31 +0000 (-0600) Subject: io_uring: don't drop completion lock before timer is fully initialized X-Git-Tag: v5.4.245~6 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=6de3014d4bd8ff3e7017614741f2dbb02bca9361;p=thirdparty%2Fkernel%2Fstable.git io_uring: don't drop completion lock before timer is fully initialized No upstream commit exists for this patch. If we drop the lock right after adding it to the timeout list, then someone attempting to kill timeouts will find it in an indeterminate state. That means that cancelation could attempt to cancel and remove a timeout, and then io_timeout() proceeds to init and add the timer afterwards. Ensure the timeout request is fully setup before we drop the completion lock, which guards cancelation as well. Reported-and-tested-by: Lee Jones Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman --- diff --git a/fs/io_uring.c b/fs/io_uring.c index cc4b6635068a8..7dbc09e4c5e94 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -2079,12 +2079,12 @@ static int io_timeout(struct io_kiocb *req, const struct io_uring_sqe *sqe) req->sequence -= span; add: list_add(&req->list, entry); - spin_unlock_irq(&ctx->completion_lock); hrtimer_init(&req->timeout.timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL); req->timeout.timer.function = io_timeout_fn; hrtimer_start(&req->timeout.timer, timespec64_to_ktime(ts), HRTIMER_MODE_REL); + spin_unlock_irq(&ctx->completion_lock); return 0; }