Commit 4aa84f2f authored by Pavel Begunkov's avatar Pavel Begunkov Committed by Jens Axboe
Browse files

io_uring: dont kill fasync under completion_lock 



      CPU0                    CPU1
       ----                    ----
  lock(&new->fa_lock);
                               local_irq_disable();
                               lock(&ctx->completion_lock);
                               lock(&new->fa_lock);
  <Interrupt>
    lock(&ctx->completion_lock);

 *** DEADLOCK ***

Move kill_fasync() out of io_commit_cqring() to io_cqring_ev_posted(),
so it doesn't hold completion_lock while doing it. That saves from the
reported deadlock, and it's just nice to shorten the locking time and
untangle nested locks (compl_lock -> wq_head::lock).

Reported-by: default avatar <syzbot+91ca3f25bd7f795f019c@syzkaller.appspotmail.com>
Signed-off-by: default avatarPavel Begunkov <asml.silence@gmail.com>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 80c18e4a

fs/io_uring.c

+8 −5
Original line number Diff line number Diff line
@@ -1345,11 +1345,6 @@ static void __io_commit_cqring(struct io_ring_ctx *ctx) 


	/* order cqe stores with ring update */

	smp_store_release(&rings->cq.tail, ctx->cached_cq_tail);



	if (wq_has_sleeper(&ctx->cq_wait)) {

		wake_up_interruptible(&ctx->cq_wait);

		kill_fasync(&ctx->cq_fasync, SIGIO, POLL_IN);

	}

}



static void io_put_identity(struct io_uring_task *tctx, struct io_kiocb *req)
@@ -1711,6 +1706,10 @@ static void io_cqring_ev_posted(struct io_ring_ctx *ctx) 
		wake_up(&ctx->sq_data->wait);

	if (io_should_trigger_evfd(ctx))

		eventfd_signal(ctx->cq_ev_fd, 1);

	if (wq_has_sleeper(&ctx->cq_wait)) {

		wake_up_interruptible(&ctx->cq_wait);

		kill_fasync(&ctx->cq_fasync, SIGIO, POLL_IN);

	}

}



static void io_cqring_ev_posted_iopoll(struct io_ring_ctx *ctx)
@@ -1721,6 +1720,10 @@ static void io_cqring_ev_posted_iopoll(struct io_ring_ctx *ctx) 
	}

	if (io_should_trigger_evfd(ctx))

		eventfd_signal(ctx->cq_ev_fd, 1);

	if (wq_has_sleeper(&ctx->cq_wait)) {

		wake_up_interruptible(&ctx->cq_wait);

		kill_fasync(&ctx->cq_fasync, SIGIO, POLL_IN);

	}

}



/* Returns true if there are no backlogged entries after the flush */