io_uring: fix ->flags races by linked timeouts
authorPavel Begunkov <asml.silence@gmail.com>
Sun, 14 Mar 2021 20:57:08 +0000 (20:57 +0000)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 7 Apr 2021 13:00:05 +0000 (15:00 +0200)
commit861fc287e03614695ddc95a752c2476c512ac8b3
tree2cacfeda0b773a720f36036f5ba30cbb461006dc
parente1f8c95c1110ab8f9945269f4b23cfb0e49c5d6d
io_uring: fix ->flags races by linked timeouts

[ Upstream commit efe814a471e0e58f28f1efaf430c8784a4f36626 ]

It's racy to modify req->flags from a not owning context, e.g. linked
timeout calling req_set_fail_links() for the master request might race
with that request setting/clearing flags while being executed
concurrently. Just remove req_set_fail_links(prev) from
io_link_timeout_fn(), io_async_find_and_cancel() and functions down the
line take care of setting the fail bit.

Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
fs/io_uring.c