redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

io_uring: hold uring_lock while completing failed polled io in io_wq_submit_work() 

io_iopoll_complete() does not hold completion_lock to complete polled io,
so in io_wq_submit_work(), we can not call io_req_complete() directly, to
complete polled io, otherwise there maybe concurrent access to cqring,
defer_list, etc, which is not safe. Commit dad1b1242f ("io_uring: always
let io_iopoll_complete() complete polled io") has fixed this issue, but
Pavel reported that IOPOLL apart from rw can do buf reg/unreg requests(
IORING_OP_PROVIDE_BUFFERS or IORING_OP_REMOVE_BUFFERS), so the fix is not
good.

Given that io_iopoll_complete() is always called under uring_lock, so here
for polled io, we can also get uring_lock to fix this issue.

Fixes: dad1b1242f ("io_uring: always let io_iopoll_complete() complete polled io")
Cc: <stable@vger.kernel.org> # 5.5+
Signed-off-by: Xiaoguang Wang <xiaoguang.wang@linux.alibaba.com>
Reviewed-by: Pavel Begunkov <asml.silence@gmail.com>
[axboe: don't deref 'req' after completing it']
Signed-off-by: Jens Axboe <axboe@kernel.dk>
zero-sugar-mainline-defconfig
Xiaoguang Wang 2020-12-14 23:49:41 +08:00 committed by Jens Axboe
parent 9faadcc8ab
commit c07e671951
1 changed files with 21 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
fs/io_uring.c
View File

@ -6332,19 +6332,28 @@ static struct io_wq_work *io_wq_submit_work(struct io_wq_work *work)
}
if (ret) {
/*
* io_iopoll_complete() does not hold completion_lock to complete
* polled io, so here for polled io, just mark it done and still let
* io_iopoll_complete() complete it.
*/
if (req->ctx->flags & IORING_SETUP_IOPOLL) {
struct kiocb *kiocb = &req->rw.kiocb;
struct io_ring_ctx *lock_ctx = NULL;
kiocb_done(kiocb, ret, NULL);
} else {
req_set_fail_links(req);
io_req_complete(req, ret);
}
if (req->ctx->flags & IORING_SETUP_IOPOLL)
lock_ctx = req->ctx;
/*
* io_iopoll_complete() does not hold completion_lock to
* complete polled io, so here for polled io, we can not call
* io_req_complete() directly, otherwise there maybe concurrent
* access to cqring, defer_list, etc, which is not safe. Given
* that io_iopoll_complete() is always called under uring_lock,
* so here for polled io, we also get uring_lock to complete
* it.
*/
if (lock_ctx)
mutex_lock(&lock_ctx->uring_lock);
req_set_fail_links(req);
io_req_complete(req, ret);
if (lock_ctx)
mutex_unlock(&lock_ctx->uring_lock);
}
return io_steal_work(req);