Commit 621fadc2 authored Jan 11, 2021 by Pavel Begunkov Committed by Jens Axboe Jan 11, 2021

io_uring: don't take files/mm for a dead task



In rare cases a task may be exiting while io_ring_exit_work() trying to
cancel/wait its requests. It's ok for __io_sq_thread_acquire_mm()
because of SQPOLL check, but is not for __io_sq_thread_acquire_files().
Play safe and fail for both of them.

Cc: stable@vger.kernel.org # 5.5+
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

parent d434ab6d

fs/io_uring.c

+5 −0

Original line number	Diff line number	Diff line
		@@ -1106,6 +1106,9 @@ static void io_sq_thread_drop_mm_files(void)

		static int __io_sq_thread_acquire_files(struct io_ring_ctx *ctx)
		{
		if (current->flags & PF_EXITING)
		return -EFAULT;

		if (!current->files) {
		struct files_struct *files;
		struct nsproxy *nsproxy;
		@@ -1133,6 +1136,8 @@ static int __io_sq_thread_acquire_mm(struct io_ring_ctx *ctx)
		{
		struct mm_struct *mm;

		if (current->flags & PF_EXITING)
		return -EFAULT;
		if (current->mm)
		return 0;