Commit 1ffc5422 authored by Pavel Begunkov's avatar Pavel Begunkov Committed by Jens Axboe
Browse files

io_uring: fix io_sqe_files_unregister() hangs 



io_sqe_files_unregister() uninterruptibly waits for enqueued ref nodes,
however requests keeping them may never complete, e.g. because of some
userspace dependency. Make sure it's interruptible otherwise it would
hang forever.

Cc: stable@vger.kernel.org # 5.6+
Signed-off-by: default avatarPavel Begunkov <asml.silence@gmail.com>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 1642b445

fs/io_uring.c

+22 −2
Original line number Diff line number Diff line
@@ -992,6 +992,10 @@ enum io_mem_account { 
	ACCT_PINNED,

};



static void destroy_fixed_file_ref_node(struct fixed_file_ref_node *ref_node);

static struct fixed_file_ref_node *alloc_fixed_file_ref_node(

			struct io_ring_ctx *ctx);



static void __io_complete_rw(struct io_kiocb *req, long res, long res2,

			     struct io_comp_state *cs);

static void io_cqring_fill_event(struct io_kiocb *req, long res);
@@ -7244,11 +7248,15 @@ static void io_sqe_files_set_node(struct fixed_file_data *file_data, 
static int io_sqe_files_unregister(struct io_ring_ctx *ctx)

{

	struct fixed_file_data *data = ctx->file_data;

	struct fixed_file_ref_node *ref_node = NULL;

	struct fixed_file_ref_node *backup_node, *ref_node = NULL;

	unsigned nr_tables, i;

	int ret;



	if (!data)

		return -ENXIO;

	backup_node = alloc_fixed_file_ref_node(ctx);

	if (!backup_node)

		return -ENOMEM;



	spin_lock_bh(&data->lock);

	ref_node = data->node;
@@ -7260,7 +7268,18 @@ static int io_sqe_files_unregister(struct io_ring_ctx *ctx) 


	/* wait for all refs nodes to complete */

	flush_delayed_work(&ctx->file_put_work);

	wait_for_completion(&data->done);

	do {

		ret = wait_for_completion_interruptible(&data->done);

		if (!ret)

			break;

		ret = io_run_task_work_sig();

		if (ret < 0) {

			percpu_ref_resurrect(&data->refs);

			reinit_completion(&data->done);

			io_sqe_files_set_node(data, backup_node);

			return ret;

		}

	} while (1);



	__io_sqe_files_unregister(ctx);

	nr_tables = DIV_ROUND_UP(ctx->nr_user_files, IORING_MAX_FILES_TABLE);
@@ -7271,6 +7290,7 @@ static int io_sqe_files_unregister(struct io_ring_ctx *ctx) 
	kfree(data);

	ctx->file_data = NULL;

	ctx->nr_user_files = 0;

	destroy_fixed_file_ref_node(backup_node);

	return 0;

}