Kernel/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2025-01-01 10:45:49 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

io_uring-6.1-2022-12-08

Browse Source 
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmOSTH0QHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgpmqXEACoMjqAV3E6E3D7aC3Q+Ngiaok8rJkRpZ9z
 8dKf+ATCw7XJMwEFix+Pqxq+O3fVfYudGiHRZA2CUCmVGkE7t2BHKxcT0vEJ2iAA
 GiyFh+BRN92vD8cwwCVwT0Z518vRHsUNFxkj65dOwUm/v02ThddkQG2mYFcZqG8f
 bKXsaSiTSrV6nxfHHuQuQ5VQcgCTjaGaFKNC7ivpi8UMT+cpcDOyWmP75JmD36s2
 xfXFFSC+gwoyMHqZnL4CyrhoH0qEtcNxSh9CEe1h7u8fc6dAw95UJtaXXH+GdlY1
 xlqYXk+yqWDzxnh9xyfJIRMs6Jm1Xk84Nz+24kB1wR/XZkwaz0ckDZRhp5oEomIa
 /8/bMVoqXnogc5pdHcCQXkT3dM33RKXbwnB7T4MrBvf6+iN3CcmHEH857VDfhzog
 hK6efbNDd6tIR9OxuSCFEiK+8w/tGmaaeMnTVdYywMwxAaGvQoKt3aLqXU00xwGy
 hN8VrHr9CUZafcOrNQ97YOexQqDaJOue2lbGu69qDlvkNwCgjbS1eTgJTIjbJtPA
 5IgQI5sVbuOoACmIT4i8H9s9+Y3UneBHaN6w6MCb0xaSV9qB+PjH0ew19yMhYZ1n
 mcxiiJel9tUVhUmF8NWu8SLCs2kVfMFYsZAblYA+35e56CHjxbmm3uTAoief+co3
 rj4ypuHm0w==
 =Ln4/
 -----END PGP SIGNATURE-----

Merge tag 'io_uring-6.1-2022-12-08' of git://git.kernel.dk/linux

Pull io_uring fix from Jens Axboe:
 "A single small fix for an issue related to ordering between
  cancelation and current->io_uring teardown"

* tag 'io_uring-6.1-2022-12-08' of git://git.kernel.dk/linux:
  io_uring: Fix a null-ptr-deref in io_tctx_exit_cb()
This commit is contained in:
Linus Torvalds 2022-12-08 15:44:09 -08:00
commit af145500af
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
io_uring/io_uring.c
View File

@ -2707,8 +2707,10 @@ static __cold void io_tctx_exit_cb(struct callback_head *cb)
/*
* When @in_idle, we're in cancellation and it's racy to remove the
* node. It'll be removed by the end of cancellation, just ignore it.
* tctx can be NULL if the queueing of this task_work raced with
* work cancelation off the exec path.
*/
if (!atomic_read(&tctx->in_idle))
if (tctx && !atomic_read(&tctx->in_idle))
io_uring_del_tctx_node((unsigned long)work->ctx);
complete(&work->completion);
}