Re: [PATCH] io_uring: hold uring_lock to complete faild polled io in io_wq_submit_work()

[Xiaoguang Wang <xiaoguang.wang@linux.alibaba.com>]

hi,

> On 12/20/20 12:36 PM, Pavel Begunkov wrote:
>> On 20/12/2020 19:34, Pavel Begunkov wrote:
>>> On 14/12/2020 15:49, Xiaoguang Wang wrote:
>>>> io_iopoll_complete() does not hold completion_lock to complete polled
>>>> io, so in io_wq_submit_work(), we can not call io_req_complete() directly,
>>>> to complete polled io, otherwise there maybe concurrent access to cqring,
>>>> defer_list, etc, which is not safe. Commit dad1b1242fd5 ("io_uring: always
>>>> let io_iopoll_complete() complete polled io") has fixed this issue, but
>>>> Pavel reported that IOPOLL apart from rw can do buf reg/unreg requests(
>>>> IORING_OP_PROVIDE_BUFFERS or IORING_OP_REMOVE_BUFFERS), so the fix is
>>>> not good.
>>>>
>>>> Given that io_iopoll_complete() is always called under uring_lock, so here
>>>> for polled io, we can also get uring_lock to fix this issue.
>>>
>>> This returns it to the state it was before fixing + mutex locking for
>>> IOPOLL, and it's much better than having it half-broken as it is now.
>>
>> btw, comments are over 80, but that's minor.
> 
> I fixed that up, but I don't particularly like how 'req' is used after
> calling complete. How about the below variant - same as before, just
> using the ctx instead to determine if we need to lock it or not.
It looks better, thanks.

Regards,
Xiaoguang Wang
> 
> 
> commit 253b60e7d8adcb980be91f77e64968a58d836b5e
> Author: Xiaoguang Wang <xiaoguang.wang@linux.alibaba.com>
> Date:   Mon Dec 14 23:49:41 2020 +0800
> 
>      io_uring: hold uring_lock while completing failed polled io in io_wq_submit_work()
>      
>      io_iopoll_complete() does not hold completion_lock to complete polled io,
>      so in io_wq_submit_work(), we can not call io_req_complete() directly, to
>      complete polled io, otherwise there maybe concurrent access to cqring,
>      defer_list, etc, which is not safe. Commit dad1b1242fd5 ("io_uring: always
>      let io_iopoll_complete() complete polled io") has fixed this issue, but
>      Pavel reported that IOPOLL apart from rw can do buf reg/unreg requests(
>      IORING_OP_PROVIDE_BUFFERS or IORING_OP_REMOVE_BUFFERS), so the fix is not
>      good.
>      
>      Given that io_iopoll_complete() is always called under uring_lock, so here
>      for polled io, we can also get uring_lock to fix this issue.
>      
>      Fixes: dad1b1242fd5 ("io_uring: always let io_iopoll_complete() complete polled io")
>      Cc: <stable@vger.kernel.org> # 5.5+
>      Signed-off-by: Xiaoguang Wang <xiaoguang.wang@linux.alibaba.com>
>      Reviewed-by: Pavel Begunkov <asml.silence@gmail.com>
>      [axboe: don't deref 'req' after completing it']
>      Signed-off-by: Jens Axboe <axboe@kernel.dk>
> 
> diff --git a/fs/io_uring.c b/fs/io_uring.c
> index b27f61e3e0d6..0a8cf3fad955 100644
> --- a/fs/io_uring.c
> +++ b/fs/io_uring.c
> @@ -6332,19 +6332,28 @@ static struct io_wq_work *io_wq_submit_work(struct io_wq_work *work)
>   	}
>   
>   	if (ret) {
> +		struct io_ring_ctx *lock_ctx = NULL;
> +
> +		if (req->ctx->flags & IORING_SETUP_IOPOLL)
> +			lock_ctx = req->ctx;
> +
>   		/*
> -		 * io_iopoll_complete() does not hold completion_lock to complete
> -		 * polled io, so here for polled io, just mark it done and still let
> -		 * io_iopoll_complete() complete it.
> +		 * io_iopoll_complete() does not hold completion_lock to
> +		 * complete polled io, so here for polled io, we can not call
> +		 * io_req_complete() directly, otherwise there maybe concurrent
> +		 * access to cqring, defer_list, etc, which is not safe. Given
> +		 * that io_iopoll_complete() is always called under uring_lock,
> +		 * so here for polled io, we also get uring_lock to complete
> +		 * it.
>   		 */
> -		if (req->ctx->flags & IORING_SETUP_IOPOLL) {
> -			struct kiocb *kiocb = &req->rw.kiocb;
> +		if (lock_ctx)
> +			mutex_lock(&lock_ctx->uring_lock);
>   
> -			kiocb_done(kiocb, ret, NULL);
> -		} else {
> -			req_set_fail_links(req);
> -			io_req_complete(req, ret);
> -		}
> +		req_set_fail_links(req);
> +		io_req_complete(req, ret);
> +
> +		if (lock_ctx)
> +			mutex_unlock(&lock_ctx->uring_lock);
>   	}
>   
>   	return io_steal_work(req);
>