io_uring: hold uring_lock when walking link chain in io_wq_free_work()

io_wq_free_work() calls io_req_find_next() from io-wq worker context,
which reads and clears req->link without holding any lock. This can
potentially race with other paths that mutate the same chain under
ctx->uring_lock.

Take ctx->uring_lock around the io_req_find_next() call. Only requests
with IO_REQ_LINK_FLAGS reach this path, which is not the hot path.

Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index 4ed998d60c09cb0706d23ce5e9a5c9da5e282607..2ebb0ba37c4f015132978068f0339dd4aa5efb5a 100644 (file)
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -1452,8 +1452,13 @@ struct io_wq_work *io_wq_free_work(struct io_wq_work *work)
        struct io_kiocb *nxt = NULL;
 
        if (req_ref_put_and_test_atomic(req)) {
-               if (req->flags & IO_REQ_LINK_FLAGS)
+               if (req->flags & IO_REQ_LINK_FLAGS) {
+                       struct io_ring_ctx *ctx = req->ctx;
+
+                       mutex_lock(&ctx->uring_lock);
                        nxt = io_req_find_next(req);
+                       mutex_unlock(&ctx->uring_lock);
+               }
                io_free_req(req);
        }
        return nxt ? &nxt->work : NULL;