提交 0930fd56 编写于 作者: J Jens Axboe 提交者: Zheng Zengkai

io_uring: kill goto error handling in io_sqpoll_wait_sq()

stable inclusion
from stable-v5.10.155
commit 0f544353fec8e717d37724d95b92538e1de79e86
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I69NMA
CVE: CVE-2022-47946

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0f544353fec8e717d37724d95b92538e1de79e86

--------------------------------

Hunk extracted from commit 70aacfe6
upstream.

If the sqpoll thread has died, the out condition doesn't remove the
waiting task from the waitqueue. The goto and check are not needed, just
make it a break condition after setting the error value. That ensures
that we always remove ourselves from sqo_sq_wait waitqueue.
Reported-by: NXingyuan Mo <hdthky0@gmail.com>
Signed-off-by: NJens Axboe <axboe@kernel.dk>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NZhihao Cheng <chengzhihao1@huawei.com>
Reviewed-by: NZhang Yi <yi.zhang@huawei.com>
Signed-off-by: NJialin Zhang <zhangjialin11@huawei.com>
上级 1657dc6a
......@@ -9073,7 +9073,7 @@ static int io_sqpoll_wait_sq(struct io_ring_ctx *ctx)
if (unlikely(ctx->sqo_dead)) {
ret = -EOWNERDEAD;
goto out;
break;
}
if (!io_sqring_full(ctx))
......@@ -9083,7 +9083,6 @@ static int io_sqpoll_wait_sq(struct io_ring_ctx *ctx)
} while (!signal_pending(current));
finish_wait(&ctx->sqo_sq_wait, &wait);
out:
return ret;
}
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册