io_uring/rw: fix downgraded mshot read

BugLink: https://bugs.launchpad.net/bugs/2106632

commit 38fc96a58ce40257aec79b32e9b310c86907c63c upstream.

The io-wq path can downgrade a multishot request to oneshot mode,
however io_read_mshot() doesn't handle that and would still post
multiple CQEs. That's not allowed, because io_req_post_cqe() requires
stricter context requirements.

The described can only happen with pollable files that don't support
FMODE_NOWAIT, which is an odd combination, so if even allowed it should
be fairly rare.

Cc: stable@vger.kernel.org
Reported-by: chase xd <sl1589472800@gmail.com>
Fixes: bee1d5becdf5b ("io_uring: disable io-wq execution of multishot NOWAIT requests")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/c5c8c4a50a882fd581257b81bf52eee260ac29fd.1735407848.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Manuel Diewald <manuel.diewald@canonical.com>
Signed-off-by: Mehmet Basaran <mehmet.basaran@canonical.com>

This commit is contained in:

Pavel Begunkov

2024-12-28 17:44:52 +00:00

committed by

Mehmet Basaran

parent a5726bb796

commit 132846323d

1 changed files with 2 additions and 0 deletions

									
										io_uring/rw.c
									
		+2
		
												View File
												
				@@ -962,6 +962,8 @@ int io_read_mshot(struct io_kiocb *req, unsigned int issue_flags)

						io_kbuf_recycle(req, issue_flags);

						if (ret < 0)

							req_set_fail(req);

					} else if (!(req->flags & REQ_F_APOLL_MULTISHOT)) {

						cflags = io_put_kbuf(req, issue_flags);

					} else {

						/*

						 * Any successful return value will keep the multishot read