• P
    io_uring: fix complete_post use ctx after free · 180f829f
    Pavel Begunkov 提交于
    If io_req_complete_post() put not a final ref, we can't rely on the
    request's ctx ref, and so ctx may potentially be freed while
    complete_post() is in io_cqring_ev_posted()/etc.
    
    In that case get an additional ctx reference, and put it in the end, so
    protecting following io_cqring_ev_posted(). And also prolong ctx
    lifetime until spin_unlock happens, as we do with mutexes, so added
    percpu_ref_get() doesn't race with ctx free.
    Signed-off-by: NPavel Begunkov <asml.silence@gmail.com>
    Signed-off-by: NJens Axboe <axboe@kernel.dk>
    180f829f
io_uring.c 240.2 KB