From: Pavel Begunkov <asml.silence@gmail.com>
To: Jens Axboe <axboe@kernel.dk>, io-uring@vger.kernel.org
Cc: Hillf Danton <hdanton@sina.com>,
syzbot+2f5d1785dc624932da78@syzkaller.appspotmail.com
Subject: [PATCH 1/2] io_uring: fix false positive sqo warning on flush
Date: Sat, 16 Jan 2021 05:32:29 +0000 [thread overview]
Message-ID: <99a4178f79b4ac35ce35111bafa0a49446b1757d.1610774936.git.asml.silence@gmail.com> (raw)
In-Reply-To: <cover.1610774936.git.asml.silence@gmail.com>
WARNING: CPU: 1 PID: 9094 at fs/io_uring.c:8884
io_disable_sqo_submit+0x106/0x130 fs/io_uring.c:8884
Call Trace:
io_uring_flush+0x28b/0x3a0 fs/io_uring.c:9099
filp_close+0xb4/0x170 fs/open.c:1280
close_fd+0x5c/0x80 fs/file.c:626
__do_sys_close fs/open.c:1299 [inline]
__se_sys_close fs/open.c:1297 [inline]
__x64_sys_close+0x2f/0xa0 fs/open.c:1297
do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
io_uring's final close() may be triggered by any task not only the
creator. It's well handled by io_uring_flush() including SQPOLL case,
though a warning in io_disable_sqo_submit() will fallaciously fire by
moving this warning out to the only call site that matters.
Reported-by: syzbot+2f5d1785dc624932da78@syzkaller.appspotmail.com
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
---
fs/io_uring.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/fs/io_uring.c b/fs/io_uring.c
index 06cc79d39586..9a67da50ae25 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -8914,8 +8914,6 @@ static void __io_uring_cancel_task_requests(struct io_ring_ctx *ctx,
static void io_disable_sqo_submit(struct io_ring_ctx *ctx)
{
- WARN_ON_ONCE(ctx->sqo_task != current);
-
mutex_lock(&ctx->uring_lock);
ctx->sqo_dead = 1;
mutex_unlock(&ctx->uring_lock);
@@ -8937,6 +8935,7 @@ static void io_uring_cancel_task_requests(struct io_ring_ctx *ctx,
if ((ctx->flags & IORING_SETUP_SQPOLL) && ctx->sq_data) {
/* for SQPOLL only sqo_task has task notes */
+ WARN_ON_ONCE(ctx->sqo_task != current);
io_disable_sqo_submit(ctx);
task = ctx->sq_data->thread;
atomic_inc(&task->io_uring->in_idle);
--
2.24.0
next prev parent reply other threads:[~2021-01-16 5:37 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-01-16 5:32 [PATCH 0/2] syzbot warning reports Pavel Begunkov
2021-01-16 5:32 ` Pavel Begunkov [this message]
2021-01-16 5:32 ` [PATCH 2/2] io_uring: fix uring_flush in exit_files() warning Pavel Begunkov
2021-01-16 19:01 ` [PATCH 0/2] syzbot warning reports Jens Axboe
[not found] ` <20210117023108.3748-1-hdanton@sina.com>
2021-01-17 2:40 ` [PATCH 2/2] io_uring: fix uring_flush in exit_files() warning Pavel Begunkov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=99a4178f79b4ac35ce35111bafa0a49446b1757d.1610774936.git.asml.silence@gmail.com \
--to=asml.silence@gmail.com \
--cc=axboe@kernel.dk \
--cc=hdanton@sina.com \
--cc=io-uring@vger.kernel.org \
--cc=syzbot+2f5d1785dc624932da78@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).