Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
io_uring/zctx: check chained notif contexts
Send zc only links ubuf_info for requests coming from the same context.
There are some ambiguous syz reports, so let's check the assumption on
notification completion.
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/fd527d8638203fe0f1c5ff06ff2e1d8fd68f831b.1755179962.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
authored by
Pavel Begunkov
and committed by
Jens Axboe
ab3ea6ea
92a96b0a
+5
+5
io_uring/notif.c
+5
io_uring/notif.c
···
14
14
static void io_notif_tw_complete(struct io_kiocb *notif, io_tw_token_t tw)
15
15
{
16
16
struct io_notif_data *nd = io_notif_to_data(notif);
17
+
struct io_ring_ctx *ctx = notif->ctx;
18
+
19
+
lockdep_assert_held(&ctx->uring_lock);
17
20
18
21
do {
19
22
notif = cmd_to_io_kiocb(nd);
20
23
24
+
if (WARN_ON_ONCE(ctx != notif->ctx))
25
+
return;
21
26
lockdep_assert(refcount_read(&nd->uarg.refcnt) == 0);
22
27
23
28
if (unlikely(nd->zc_report) && (nd->zc_copied || !nd->zc_used))