tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

io_uring/tctx: mark io_wq as exiting before error path teardown

syzbot reports that it's hitting the below condition for exiting an
io_wq context:

WARN_ON_ONCE(!test_bit(IO_WQ_BIT_EXIT, &wq->state))

in io_wq_put_and_exit(), which can be triggered with memory allocation
fault injection. Ensure that the io_wq is marked as exiting to silence
this warning trigger.

Reported-by: syzbot+79a4cc863a8db58cd92b@syzkaller.appspotmail.com
Fixes: 7880174e1e5e ("io_uring/tctx: clean up __io_uring_add_tctx_node() error handling")
Reviewed-by: Clément Léger <cleger@meta.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

Jens Axboe 41859843 ee5417fd

+3 -1
+3 -1
io_uring/tctx.c
··· 171 171 } 172 172 if (!current->io_uring) { 173 173 err_free: 174 - if (tctx->io_wq) 174 + if (tctx->io_wq) { 175 + io_wq_exit_start(tctx->io_wq); 175 176 io_wq_put_and_exit(tctx->io_wq); 177 + } 176 178 percpu_counter_destroy(&tctx->inflight); 177 179 kfree(tctx); 178 180 }