archives/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-03-13 22:36:17 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

ublk: move ublk_mark_io_ready() out of __ublk_fetch()

Browse source 
ublk_batch_prep_io() calls __ublk_fetch() while holding io->lock
spinlock. When the last IO makes the device ready, ublk_mark_io_ready()
tries to acquire ub->cancel_mutex which can sleep, causing a
sleeping-while-atomic bug.

Fix by moving ublk_mark_io_ready() out of __ublk_fetch() and into the
callers (ublk_fetch and ublk_batch_prep_io) after the spinlock is
released.

Reported-by: Jens Axboe <axboe@kernel.dk>
Fixes: b256795b36 ("ublk: handle UBLK_U_IO_PREP_IO_CMDS")
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
This commit is contained in:
Ming Lei 2026-01-23 17:15:42 +08:00 • committed by Jens Axboe
parent e8cd481cc6
commit dbc635c4be
1 changed files with 5 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

6
drivers/block/ublk_drv.c
View file

@ -3064,7 +3064,6 @@ static int __ublk_fetch(struct io_uring_cmd *cmd, struct ublk_device *ub,
WRITE_ONCE(io->task, NULL);
else
WRITE_ONCE(io->task, get_task_struct(current));
ublk_mark_io_ready(ub, q_id);
return 0;
}
@ -3083,6 +3082,8 @@ static int ublk_fetch(struct io_uring_cmd *cmd, struct ublk_device *ub,
ret = __ublk_fetch(cmd, ub, io, q_id);
if (!ret)
ret = ublk_config_io_buf(ub, io, cmd, buf_addr, NULL);
if (!ret)
ublk_mark_io_ready(ub, q_id);
mutex_unlock(&ub->mutex);
return ret;
}
@ -3484,6 +3485,9 @@ static int ublk_batch_prep_io(struct ublk_queue *ubq,
io->buf = buf;
ublk_io_unlock(io);
if (!ret)
ublk_mark_io_ready(data->ub, ubq->q_id);
return ret;
}