diff options
| author | ZiyangZhang <ZiyangZhang@linux.alibaba.com> | 2022-08-15 10:36:33 +0800 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2022-08-16 06:16:19 -0600 |
| commit | e6190dd0031d335c22586d34ef898301ed20f230 (patch) | |
| tree | cc5a1c49ac71efb5d21d0ed9b6f76f02f42b5e77 /include | |
| parent | bb24174754afc5a7d185ca5406dcfbc608cdf157 (diff) | |
ublk_drv: do not add a re-issued request aborted previously to ioucmd's task_work
In ublk_queue_rq(), Assume current request is a re-issued request aborted
previously in monitor_work because the ubq_daemon(ioucmd's task) is
PF_EXITING. For this request, we cannot call
io_uring_cmd_complete_in_task() anymore because at that moment io_uring
context may be freed in case that no inflight ioucmd exists. Otherwise,
we may cause null-deref in ctx->fallback_work.
Add a check on UBLK_IO_FLAG_ABORTED to prevent the above situation. This
check is safe and makes sense.
Note: monitor_work sets UBLK_IO_FLAG_ABORTED and ends this request
(releasing the tag). Then the request is restarted(allocating the tag)
and we are here. Since releasing/allocating a tag implies smp_mb(),
finding UBLK_IO_FLAG_ABORTED guarantees that here is a re-issued request
aborted previously.
Suggested-by: Ming Lei <ming.lei@redhat.com>
Signed-off-by: ZiyangZhang <ZiyangZhang@linux.alibaba.com>
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Link: https://lore.kernel.org/r/20220815023633.259825-4-ZiyangZhang@linux.alibaba.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'include')
0 files changed, 0 insertions, 0 deletions