leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

io_uring: fix io_sqe_files_unregister() hangs

Browse Source 
io_sqe_files_unregister() uninterruptibly waits for enqueued ref nodes,
however requests keeping them may never complete, e.g. because of some
userspace dependency. Make sure it's interruptible otherwise it would
hang forever.

Cc: stable@vger.kernel.org # 5.6+
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
This commit is contained in:
Pavel Begunkov 2020-12-30 21:34:15 +00:00 committed by Jens Axboe
parent 1642b4450d
commit 1ffc54220c
1 changed files with 22 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
fs/io_uring.c
View File

@ -992,6 +992,10 @@ enum io_mem_account {
ACCT_PINNED, ACCT_PINNED,
}; };
static void destroy_fixed_file_ref_node(struct fixed_file_ref_node *ref_node);
static struct fixed_file_ref_node *alloc_fixed_file_ref_node(
struct io_ring_ctx *ctx);
static void __io_complete_rw(struct io_kiocb *req, long res, long res2, static void __io_complete_rw(struct io_kiocb *req, long res, long res2,
struct io_comp_state *cs); struct io_comp_state *cs);
static void io_cqring_fill_event(struct io_kiocb *req, long res); static void io_cqring_fill_event(struct io_kiocb *req, long res);
@ -7244,11 +7248,15 @@ static void io_sqe_files_set_node(struct fixed_file_data *file_data,
static int io_sqe_files_unregister(struct io_ring_ctx *ctx) static int io_sqe_files_unregister(struct io_ring_ctx *ctx)
{ {
struct fixed_file_data *data = ctx->file_data; struct fixed_file_data *data = ctx->file_data;
struct fixed_file_ref_node *ref_node = NULL; struct fixed_file_ref_node *backup_node, *ref_node = NULL;
unsigned nr_tables, i; unsigned nr_tables, i;
int ret;
if (!data) if (!data)
return -ENXIO; return -ENXIO;
backup_node = alloc_fixed_file_ref_node(ctx);
if (!backup_node)
return -ENOMEM;
spin_lock_bh(&data->lock); spin_lock_bh(&data->lock);
ref_node = data->node; ref_node = data->node;
@ -7260,7 +7268,18 @@ static int io_sqe_files_unregister(struct io_ring_ctx *ctx)
/* wait for all refs nodes to complete */ /* wait for all refs nodes to complete */
flush_delayed_work(&ctx->file_put_work); flush_delayed_work(&ctx->file_put_work);
wait_for_completion(&data->done); do {
ret = wait_for_completion_interruptible(&data->done);
if (!ret)
break;
ret = io_run_task_work_sig();
if (ret < 0) {
percpu_ref_resurrect(&data->refs);
reinit_completion(&data->done);
io_sqe_files_set_node(data, backup_node);
return ret;
}
} while (1);
__io_sqe_files_unregister(ctx); __io_sqe_files_unregister(ctx);
nr_tables = DIV_ROUND_UP(ctx->nr_user_files, IORING_MAX_FILES_TABLE); nr_tables = DIV_ROUND_UP(ctx->nr_user_files, IORING_MAX_FILES_TABLE);
@ -7271,6 +7290,7 @@ static int io_sqe_files_unregister(struct io_ring_ctx *ctx)
kfree(data); kfree(data);
ctx->file_data = NULL; ctx->file_data = NULL;
ctx->nr_user_files = 0; ctx->nr_user_files = 0;
destroy_fixed_file_ref_node(backup_node);
return 0; return 0;
} }