io_uring: Fix race for sqes with userspace
authorPavel Begunkov <asml.silence@gmail.com>
Fri, 25 Oct 2019 09:31:31 +0000 (12:31 +0300)
committerJens Axboe <axboe@kernel.dk>
Fri, 25 Oct 2019 15:02:01 +0000 (09:02 -0600)
commit935d1e45908afb8853c497f2c2bbbb685dec51dc
tree408e5c91fcd34aaa19d71fb4c672d89bf3e9c756
parentfb5ccc98782f654778cb8d96ba8a998304f9a51f
io_uring: Fix race for sqes with userspace

io_ring_submit() finalises with
1. io_commit_sqring(), which releases sqes to the userspace
2. Then calls to io_queue_link_head(), accessing released head's sqe

Reorder them.

Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
fs/io_uring.c