Jens Axboe 6b358b3adf io_uring/sqpoll: don't put task_struct on tctx setup failure ...

[ Upstream commit f2320f1dd6 ]

A recent commit moved the error handling of sqpoll thread and tctx
failures into the thread itself, as part of fixing an issue. However, it
missed that tctx allocation may also fail, and that
io_sq_offload_create() does its own error handling for the task_struct
in that case.

Remove the manual task putting in io_sq_offload_create(), as
io_sq_thread() will notice that the tctx did not get setup and hence it
should put itself and exit.

Reported-by: syzbot+763e12bbf004fb1062e4@syzkaller.appspotmail.com
Fixes: ac0b8b327a ("io_uring: fix use-after-free of sq->thread in __io_uring_show_fdinfo()")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2025-06-27 11:11:42 +01:00

..

advise.c

io_uring/advise: support 64-bit lengths

2024-06-16 14:54:55 -06:00

advise.h

…

alloc_cache.h

…

cancel.c

…

cancel.h

io_uring: fix cancellation overwriting req->flags

2024-06-13 19:25:28 -06:00

epoll.c

…

epoll.h

…

eventfd.c

io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period

2025-01-17 13:40:58 +01:00

eventfd.h

io_uring/eventfd: move eventfd handling to separate file

2024-06-16 14:54:55 -06:00

fdinfo.c

io_uring: fix use-after-free of sq->thread in __io_uring_show_fdinfo()

2025-06-19 15:32:33 +02:00

fdinfo.h

…

filetable.c

…

filetable.h

…

fs.c

…

fs.h

…

futex.c

futex: Pass in task to futex_queue()

2025-03-22 12:54:14 -07:00

futex.h

…

io_uring.c

io_uring: account drain memory to cgroup

2025-06-27 11:11:13 +01:00

io_uring.h

io_uring/sqpoll: ensure task state is TASK_RUNNING when running task_work

2024-10-17 08:38:04 -06:00

io-wq.c

io_uring: fix task leak issue in io_wq_create()

2025-06-27 11:11:36 +01:00

io-wq.h

io_uring/io-wq: make io_wq_work flags atomic

2024-06-16 14:54:55 -06:00

kbuf.c

io_uring/kbuf: don't truncate end buffer for multiple buffer peeks

2025-06-27 11:11:36 +01:00

kbuf.h

io_uring/kbuf: add support for incremental buffer consumption

2024-08-29 08:44:58 -06:00

Makefile

io_uring: add GCOV_PROFILE_URING Kconfig option

2024-08-30 10:52:02 -06:00

memmap.c

io_uring: check for overflows in io_pin_pages

2024-12-05 14:02:50 +01:00

memmap.h

…

msg_ring.c

io_uring/msg: initialise msg request opcode

2025-05-29 11:02:03 +02:00

msg_ring.h

io_uring/msg_ring: add an alloc cache for io_kiocb entries

2024-06-24 08:39:55 -06:00

napi.c

io_uring: user registered clockid for wait timeouts

2024-08-25 08:27:01 -06:00

napi.h

io_uring/napi: postpone napi timeout adjustment

2024-08-25 08:27:01 -06:00

net.c

io_uring/net: fix io_req_post_cqe abuse by send bundle

2025-04-20 10:15:40 +02:00

net.h

io_uring: Introduce IORING_OP_LISTEN

2024-06-19 07:57:21 -06:00

nop.c

…

nop.h

…

notif.c

…

notif.h

…

opdef.c

io_uring: Fix probe of disabled operations

2024-06-19 08:58:00 -06:00

opdef.h

io_uring: Fix probe of disabled operations

2024-06-19 08:58:00 -06:00

openclose.c

…

openclose.h

…

poll.c

io_uring/net: don't retry connect operation on EPOLLERR

2025-02-17 10:05:38 +01:00

poll.h

…

refs.h

io_uring: always do atomic put from iowq

2025-05-02 07:59:21 +02:00

register.c

io_uring: consistently use rcu semantics with sqpoll thread

2025-06-19 15:32:33 +02:00

register.h

io_uring: clean up a type in io_uring_register_get_file()

2024-09-16 12:04:10 -06:00

rsrc.c

io_uring/rsrc: require cloned buffers to share accounting contexts

2025-02-01 18:39:40 +01:00

rsrc.h

io_uring/rsrc: change ubuf->ubuf_end to length tracking

2024-09-15 09:15:22 -06:00

rw.c

block: add a rq_list type

2025-04-25 10:48:06 +02:00

rw.h

…

slist.h

…

splice.c

…

splice.h

…

sqpoll.c

io_uring/sqpoll: don't put task_struct on tctx setup failure

2025-06-27 11:11:42 +01:00

sqpoll.h

io_uring: consistently use rcu semantics with sqpoll thread

2025-06-19 15:32:33 +02:00

statx.c

vfs: retire user_path_at_empty and drop empty arg from getname_flags

2024-06-05 17:03:57 +02:00

statx.h

…

sync.c

…

sync.h

…

tctx.c

io_uring/tctx: work around xa_store() allocation error issue

2024-12-14 20:04:10 +01:00

tctx.h

…

timeout.c

io_uring/timeout: fix multishot updates

2025-01-17 13:40:51 +01:00

timeout.h

…

truncate.c

…

truncate.h

…

uring_cmd.c

io_uring/uring_cmd: remove dead req_has_async_data() check

2025-02-21 14:01:20 +01:00

uring_cmd.h

…

waitid.c

io_uring/waitid: don't abuse io_tw_state

2025-02-21 14:01:20 +01:00

waitid.h

…

xattr.c

vfs: retire user_path_at_empty and drop empty arg from getname_flags

2024-06-05 17:03:57 +02:00

xattr.h

…