io_uring: fix race with canceling timeouts
authorJens Axboe <axboe@kernel.dk>
Tue, 29 Oct 2019 18:34:10 +0000 (12:34 -0600)
committerJens Axboe <axboe@kernel.dk>
Tue, 29 Oct 2019 21:43:30 +0000 (15:43 -0600)
commit842f96124c5617b060cc0f071dcfb6ab24bdd042
tree2cd9617a5a7f63c53262dbd7aee1b5aefdaa3af7
parent65e19f54d29cd8559ce60cfd0d751bef7afbdc5c
io_uring: fix race with canceling timeouts

If we get -1 from hrtimer_try_to_cancel(), we know that the timer
is running. Hence leave all completion to the timeout handler. If
we don't, we can corrupt the list and miss a completion.

Fixes: 11365043e527 ("io_uring: add support for canceling timeout requests")
Reported-by: Hrvoje Zeba <zeba.hrvoje@gmail.com>
Tested-by: Hrvoje Zeba <zeba.hrvoje@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
fs/io_uring.c