Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'io_uring-6.1-2022-12-08' of git://git.kernel.dk/linux
Pull io_uring fix from Jens Axboe:
"A single small fix for an issue related to ordering between
cancelation and current->io_uring teardown"
* tag 'io_uring-6.1-2022-12-08' of git://git.kernel.dk/linux:
io_uring: Fix a null-ptr-deref in io_tctx_exit_cb()
+3
-1
+3
-1
io_uring/io_uring.c
+3
-1
io_uring/io_uring.c
···
2707
2707
/*
2708
2708
* When @in_idle, we're in cancellation and it's racy to remove the
2709
2709
* node. It'll be removed by the end of cancellation, just ignore it.
2710
+
* tctx can be NULL if the queueing of this task_work raced with
2711
+
* work cancelation off the exec path.
2710
2712
*/
2711
-
if (!atomic_read(&tctx->in_idle))
2713
+
if (tctx && !atomic_read(&tctx->in_idle))
2712
2714
io_uring_del_tctx_node((unsigned long)work->ctx);
2713
2715
complete(&work->completion);
2714
2716
}