FAILED: patch "[PATCH] io_uring: ensure SQPOLL startup is triggered before error" failed to apply to 5.11-stable tree

FAILED: patch "[PATCH] io_uring: ensure SQPOLL startup is triggered before error" failed to apply to 5.11-stable tree

[gregkh]

The patch below does not apply to the 5.11-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From eb85890b29e4d7ae1accdcfba35ed8b16ba9fb97 Mon Sep 17 00:00:00 2001
From: Jens Axboe <axboe@kernel.dk>
Date: Thu, 25 Feb 2021 10:13:29 -0700
Subject: [PATCH] io_uring: ensure SQPOLL startup is triggered before error
 shutdown

syzbot reports the following hang:

INFO: task syz-executor.0:12538 can't die for more than 143 seconds.
task:syz-executor.0  state:D stack:28352 pid:12538 ppid:  8423 flags:0x00004004
Call Trace:
 context_switch kernel/sched/core.c:4324 [inline]
 __schedule+0x90c/0x21a0 kernel/sched/core.c:5075
 schedule+0xcf/0x270 kernel/sched/core.c:5154
 schedule_timeout+0x1db/0x250 kernel/time/timer.c:1868
 do_wait_for_common kernel/sched/completion.c:85 [inline]
 __wait_for_common kernel/sched/completion.c:106 [inline]
 wait_for_common kernel/sched/completion.c:117 [inline]
 wait_for_completion+0x168/0x270 kernel/sched/completion.c:138
 io_sq_thread_finish+0x96/0x580 fs/io_uring.c:7152
 io_sq_offload_create fs/io_uring.c:7929 [inline]
 io_uring_create fs/io_uring.c:9465 [inline]
 io_uring_setup+0x1fb2/0x2c20 fs/io_uring.c:9550
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xae

which is due to exiting after the SQPOLL thread has been created, but
hasn't been started yet. Ensure that we always complete the startup
side when waiting for it to exit.

Reported-by: syzbot+c927c937cba8ef66dd4a@syzkaller.appspotmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/fs/io_uring.c b/fs/io_uring.c
index fbc85afa9a87..ef743594d34a 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -7141,6 +7141,7 @@ static void io_sq_thread_finish(struct io_ring_ctx *ctx)
 	struct io_sq_data *sqd = ctx->sq_data;
 
 	if (sqd) {
+		complete(&sqd->startup);
 		if (sqd->thread) {
 			wait_for_completion(&ctx->sq_thread_comp);
 			io_sq_thread_park(sqd);
@@ -7927,7 +7928,7 @@ static void io_sq_offload_start(struct io_ring_ctx *ctx)
 {
 	struct io_sq_data *sqd = ctx->sq_data;
 
-	if ((ctx->flags & IORING_SETUP_SQPOLL) && sqd->thread)
+	if (ctx->flags & IORING_SETUP_SQPOLL)
 		complete(&sqd->startup);
 }
 

Re: FAILED: patch "[PATCH] io_uring: ensure SQPOLL startup is triggered before error" failed to apply to 5.11-stable tree

[Sasha Levin]

On Mon, Mar 29, 2021 at 08:36:36AM +0200, gregkh@linuxfoundation.org wrote:
>
>The patch below does not apply to the 5.11-stable tree.
>If someone wants it applied there, or to any other stable or longterm
>tree, then please email the backport, including the original git commit
>id to <stable@vger.kernel.org>.
>
>thanks,
>
>greg k-h
>
>------------------ original commit in Linus's tree ------------------
>
>From eb85890b29e4d7ae1accdcfba35ed8b16ba9fb97 Mon Sep 17 00:00:00 2001
>From: Jens Axboe <axboe@kernel.dk>
>Date: Thu, 25 Feb 2021 10:13:29 -0700
>Subject: [PATCH] io_uring: ensure SQPOLL startup is triggered before error
> shutdown
>
>syzbot reports the following hang:
>
>INFO: task syz-executor.0:12538 can't die for more than 143 seconds.
>task:syz-executor.0  state:D stack:28352 pid:12538 ppid:  8423 flags:0x00004004
>Call Trace:
> context_switch kernel/sched/core.c:4324 [inline]
> __schedule+0x90c/0x21a0 kernel/sched/core.c:5075
> schedule+0xcf/0x270 kernel/sched/core.c:5154
> schedule_timeout+0x1db/0x250 kernel/time/timer.c:1868
> do_wait_for_common kernel/sched/completion.c:85 [inline]
> __wait_for_common kernel/sched/completion.c:106 [inline]
> wait_for_common kernel/sched/completion.c:117 [inline]
> wait_for_completion+0x168/0x270 kernel/sched/completion.c:138
> io_sq_thread_finish+0x96/0x580 fs/io_uring.c:7152
> io_sq_offload_create fs/io_uring.c:7929 [inline]
> io_uring_create fs/io_uring.c:9465 [inline]
> io_uring_setup+0x1fb2/0x2c20 fs/io_uring.c:9550
> do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
> entry_SYSCALL_64_after_hwframe+0x44/0xae
>
>which is due to exiting after the SQPOLL thread has been created, but
>hasn't been started yet. Ensure that we always complete the startup
>side when waiting for it to exit.

I *think* that this patch fixes 37d1e2e3642e ("io_uring: move SQPOLL
thread io-wq forked worker"), so we don't need to backport it.

-- 
Thanks,
Sasha