diff options
| author | Pavel Begunkov <asml.silence@gmail.com> | 2020-08-25 01:42:35 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-08-27 10:31:49 +0300 |
| commit | 44f639d5aeda30318fc86aec2fe99581fc24a134 (patch) | |
| tree | bb6eb2f617f8917c73bd38a952ad89289d480a40 | |
| parent | 3f4be7a7db9fa51929ea22f0cdcfa0abdbf1573f (diff) | |
| download | linux-44f639d5aeda30318fc86aec2fe99581fc24a134.tar.xz | |
io_uring: fix missing ->mm on exit
Upstream commits:
8eb06d7e8dd85 ("io_uring: fix missing ->mm on exit")
cbcf72148da4a ("io_uring: return locked and pinned page accounting")
do_exit() first drops current->mm and then runs task_work, from where
io_sq_thread_acquire_mm() would try to set mm for a user dying process.
[ 208.004249] WARNING: CPU: 2 PID: 1854 at
kernel/kthread.c:1238 kthread_use_mm+0x244/0x270
[ 208.004287] kthread_use_mm+0x244/0x270
[ 208.004288] io_sq_thread_acquire_mm.part.0+0x54/0x80
[ 208.004290] io_async_task_func+0x258/0x2ac
[ 208.004291] task_work_run+0xc8/0x210
[ 208.004294] do_exit+0x1b8/0x430
[ 208.004295] do_group_exit+0x44/0xac
[ 208.004296] get_signal+0x164/0x69c
[ 208.004298] do_signal+0x94/0x1d0
[ 208.004299] do_notify_resume+0x18c/0x340
[ 208.004300] work_pending+0x8/0x3d4
Reported-by: Roman Gershman <romange@gmail.com>
Tested-by: Roman Gershman <romange@gmail.com>
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | fs/io_uring.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/fs/io_uring.c b/fs/io_uring.c index dd8ad87540ef..26978630378e 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -4363,7 +4363,8 @@ static int io_sq_thread_acquire_mm(struct io_ring_ctx *ctx, struct io_kiocb *req) { if (io_op_defs[req->opcode].needs_mm && !current->mm) { - if (unlikely(!mmget_not_zero(ctx->sqo_mm))) + if (unlikely(!(ctx->flags & IORING_SETUP_SQPOLL) || + !mmget_not_zero(ctx->sqo_mm))) return -EFAULT; kthread_use_mm(ctx->sqo_mm); } |