-
- Downloads
io_uring: consider the overflow of sequence for timeout req
mainline inclusion from mainline-5.4-rc4 commit 5da0fb1a category: feature bugzilla: https://bugzilla.openeuler.org/show_bug.cgi?id=27 CVE: NA --------------------------- Now we recalculate the sequence of timeout with 'req->sequence = ctx->cached_sq_head + count - 1', judge the right place to insert for timeout_list by compare the number of request we still expected for completion. But we have not consider about the situation of overflow: 1. ctx->cached_sq_head + count - 1 may overflow. And a bigger count for the new timeout req can have a small req->sequence. 2. cached_sq_head of now may overflow compare with before req. And it will lead the timeout req with small req->sequence. This overflow will lead to the misorder of timeout_list, which can lead to the wrong order of the completion of timeout_list. Fix it by reuse req->submit.sequence to store the count, and change the logic of inserting sort in io_timeout. Signed-off-by:yangerkun <yangerkun@huawei.com> Signed-off-by:
Jens Axboe <axboe@kernel.dk> Signed-off-by:
Zhihao Cheng <chengzhihao1@huawei.com> Signed-off-by:
yangerkun <yangerkun@huawei.com> Reviewed-by:
zhangyi (F) <yi.zhang@huawei.com> Signed-off-by:
Cheng Jian <cj.chengjian@huawei.com>
Please register or sign in to comment