[PATCH] io_uring: fix __io_iopoll_check deadlock in io_sq_thread

[PATCH] io_uring: fix __io_iopoll_check deadlock in io_sq_thread

[Xiaoguang Wang]

Since commit a3a0e43fd770 ("io_uring: don't enter poll loop if we have
CQEs pending"), if we already events pending, we won't enter poll loop.
In case SETUP_IOPOLL and SETUP_SQPOLL are both enabled, if app has
been terminated and don't reap pengding events which are already in cq
ring, and there are some reqs in poll_list, io_sq_thread will enter
__io_iopoll_check(), and find pending events, then return, this loop
will never have a chance to exit.

I have seem this issue in fio stress tests, to fix this issue, let
io_sq_thread call io_iopoll_getevents() with argument 'min' being zero,
and remove __io_iopoll_check().

Fixes: a3a0e43fd770 ("io_uring: don't enter poll loop if we have CQEs pending")
Signed-off-by: Xiaoguang Wang <xiaoguang.wang@linux.alibaba.com>
---
 fs/io_uring.c | 27 +++++++++------------------
 1 file changed, 9 insertions(+), 18 deletions(-)

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 77f22c3da30f..c69870b0c0ca 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -1635,11 +1635,17 @@ static void io_iopoll_reap_events(struct io_ring_ctx *ctx)
 	mutex_unlock(&ctx->uring_lock);
 }
 
-static int __io_iopoll_check(struct io_ring_ctx *ctx, unsigned *nr_events,
-			    long min)
+static int io_iopoll_check(struct io_ring_ctx *ctx, unsigned *nr_events,
+			   long min)
 {
 	int iters = 0, ret = 0;
 
+	/*
+	 * We disallow the app entering submit/complete with polling, but we
+	 * still need to lock the ring to prevent racing with polled issue
+	 * that got punted to a workqueue.
+	 */
+	mutex_lock(&ctx->uring_lock);
 	do {
 		int tmin = 0;
 
@@ -1675,21 +1681,6 @@ static int __io_iopoll_check(struct io_ring_ctx *ctx, unsigned *nr_events,
 		ret = 0;
 	} while (min && !*nr_events && !need_resched());
 
-	return ret;
-}
-
-static int io_iopoll_check(struct io_ring_ctx *ctx, unsigned *nr_events,
-			   long min)
-{
-	int ret;
-
-	/*
-	 * We disallow the app entering submit/complete with polling, but we
-	 * still need to lock the ring to prevent racing with polled issue
-	 * that got punted to a workqueue.
-	 */
-	mutex_lock(&ctx->uring_lock);
-	ret = __io_iopoll_check(ctx, nr_events, min);
 	mutex_unlock(&ctx->uring_lock);
 	return ret;
 }
@@ -5039,7 +5030,7 @@ static int io_sq_thread(void *data)
 				 */
 				mutex_lock(&ctx->uring_lock);
 				if (!list_empty(&ctx->poll_list))
-					__io_iopoll_check(ctx, &nr_events, 0);
+					io_iopoll_getevents(ctx, &nr_events, 0);
 				else
 					inflight = 0;
 				mutex_unlock(&ctx->uring_lock);
-- 
2.17.2

Re: [PATCH] io_uring: fix __io_iopoll_check deadlock in io_sq_thread

[Jens Axboe]

On 2/21/20 11:46 PM, Xiaoguang Wang wrote:
> Since commit a3a0e43fd770 ("io_uring: don't enter poll loop if we have
> CQEs pending"), if we already events pending, we won't enter poll loop.
> In case SETUP_IOPOLL and SETUP_SQPOLL are both enabled, if app has
> been terminated and don't reap pengding events which are already in cq
> ring, and there are some reqs in poll_list, io_sq_thread will enter
> __io_iopoll_check(), and find pending events, then return, this loop
> will never have a chance to exit.
> 
> I have seem this issue in fio stress tests, to fix this issue, let
> io_sq_thread call io_iopoll_getevents() with argument 'min' being zero,
> and remove __io_iopoll_check().

Thanks, nice and clean fix. Applied for 5.6.

-- 
Jens Axboe