io_uring: fail io_uring_register(2) on a dying io_uring instance
If we have multiple threads doing io_uring_register(2) on an io_uring fd, then we can potentially try and kill the percpu reference while someone else has already killed it. Prevent this race by failing io_uring_register(2) if the ref is marked dying. This is safe since we're inside the io_uring mutex. Fixes: b19062a5 ("io_uring: fix possible deadlock between io_uring_{enter,register}") Reported-by: Nsyzbot <syzbot+10d25e23199614b7721f@syzkaller.appspotmail.com> Signed-off-by: NJens Axboe <axboe@kernel.dk>
Showing
想要评论请 注册 或 登录