Re: [RFC] io_uring: fix possible poll event lost in multi shot mode

[Jens Axboe <axboe@kernel.dk>]

On 9/2/21 8:48 AM, Xiaoguang Wang wrote:
> IIUC, IORING_POLL_ADD_MULTI is similar to epoll's edge-triggered mode,
> that means once one pure poll request returns one event(cqe), we'll
> need to read or write continually until EAGAIN is returned, then I think
> there is a possible poll event lost race in multi shot mode:
> 
> t1  poll request add |                         |
> t2                   |                         |
> t3  event happens    |                         |
> t4  task work add    |                         |
> t5                   | task work run           |
> t6                   |   commit one cqe        |
> t7                   |                         | user app handles cqe
> t8                   |   new event happen      |
> t9                   |   add back to waitqueue |
> t10                  |
> 
> After t6 but before t9, if new event happens, there'll be no wakeup
> operation, and if user app has picked up this cqe in t7, read or write
> until EAGAIN is returned. In t8, new event happens and will be lost,
> though this race window maybe small.
> 
> To fix this possible race, add poll request back to waitqueue before
> committing cqe.

This looks sane to me. Probably just needs a:

Fixes: 88e41cf928a6 ("io_uring: add multishot mode for IORING_OP_POLL_ADD")

tag.

-- 
Jens Axboe