[PATCH v2 4/7] io_uring: split __io_cqring_overflow_flush()

[Pavel Begunkov <asml.silence@gmail.com>]

Extract a helper function from __io_cqring_overflow_flush() and keep the
CQ locking and lock dropping in the caller.

Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
---
 io_uring/io_uring.c | 57 +++++++++++++++++++++++++--------------------
 1 file changed, 32 insertions(+), 25 deletions(-)

diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index fff9812f53c0..a2a4e1319033 100644
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -617,56 +617,63 @@ static void io_cq_unlock_post(struct io_ring_ctx *ctx)
 	io_commit_cqring_flush(ctx);
 }
 
-static void __io_cqring_overflow_flush(struct io_ring_ctx *ctx, bool dying)
+static bool io_flush_overflow_list(struct io_ring_ctx *ctx, bool dying)
 {
 	size_t cqe_size = sizeof(struct io_uring_cqe);
 
-	lockdep_assert_held(&ctx->uring_lock);
-
-	/* don't abort if we're dying, entries must get freed */
-	if (!dying && __io_cqring_events(ctx) == ctx->cq_entries)
-		return;
-
 	if (ctx->flags & IORING_SETUP_CQE32)
 		cqe_size <<= 1;
 
-	io_cq_lock(ctx);
 	while (!list_empty(&ctx->cq_overflow_list)) {
 		struct io_uring_cqe *cqe;
 		struct io_overflow_cqe *ocqe;
 
+		/*
+		 * For silly syzbot cases that deliberately overflow by huge
+		 * amounts, check if we need to resched and drop and
+		 * reacquire the locks if so. Nothing real would ever hit this.
+		 * Ideally we'd have a non-posting unlock for this, but hard
+		 * to care for a non-real case.
+		 */
+		if (need_resched())
+			return false;
+
 		ocqe = list_first_entry(&ctx->cq_overflow_list,
 					struct io_overflow_cqe, list);
 
 		if (!dying) {
 			if (!io_get_cqe_overflow(ctx, &cqe, true))
-				break;
+				return true;
 			memcpy(cqe, &ocqe->cqe, cqe_size);
 		}
 		list_del(&ocqe->list);
 		kfree(ocqe);
-
-		/*
-		 * For silly syzbot cases that deliberately overflow by huge
-		 * amounts, check if we need to resched and drop and
-		 * reacquire the locks if so. Nothing real would ever hit this.
-		 * Ideally we'd have a non-posting unlock for this, but hard
-		 * to care for a non-real case.
-		 */
-		if (need_resched()) {
-			ctx->cqe_sentinel = ctx->cqe_cached;
-			io_cq_unlock_post(ctx);
-			mutex_unlock(&ctx->uring_lock);
-			cond_resched();
-			mutex_lock(&ctx->uring_lock);
-			io_cq_lock(ctx);
-		}
 	}
 
 	if (list_empty(&ctx->cq_overflow_list)) {
 		clear_bit(IO_CHECK_CQ_OVERFLOW_BIT, &ctx->check_cq);
 		atomic_andnot(IORING_SQ_CQ_OVERFLOW, &ctx->rings->sq_flags);
 	}
+	return true;
+}
+
+static void __io_cqring_overflow_flush(struct io_ring_ctx *ctx, bool dying)
+{
+	lockdep_assert_held(&ctx->uring_lock);
+
+	/* don't abort if we're dying, entries must get freed */
+	if (!dying && __io_cqring_events(ctx) == ctx->cq_entries)
+		return;
+
+	io_cq_lock(ctx);
+	while (!io_flush_overflow_list(ctx, dying)) {
+		ctx->cqe_sentinel = ctx->cqe_cached;
+		io_cq_unlock_post(ctx);
+		mutex_unlock(&ctx->uring_lock);
+		cond_resched();
+		mutex_lock(&ctx->uring_lock);
+		io_cq_lock(ctx);
+	}
 	io_cq_unlock_post(ctx);
 }
 
-- 
2.49.0