io-uring.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [RFC] io_uring: fix possible poll event lost in multi shot mode
@ 2021-09-02 14:48 Xiaoguang Wang
  2021-09-02 16:11 ` Jens Axboe
  0 siblings, 1 reply; 2+ messages in thread
From: Xiaoguang Wang @ 2021-09-02 14:48 UTC (permalink / raw)
  To: io-uring; +Cc: axboe, asml.silence, Xiaoguang Wang

IIUC, IORING_POLL_ADD_MULTI is similar to epoll's edge-triggered mode,
that means once one pure poll request returns one event(cqe), we'll
need to read or write continually until EAGAIN is returned, then I think
there is a possible poll event lost race in multi shot mode:

t1  poll request add |                         |
t2                   |                         |
t3  event happens    |                         |
t4  task work add    |                         |
t5                   | task work run           |
t6                   |   commit one cqe        |
t7                   |                         | user app handles cqe
t8                   |   new event happen      |
t9                   |   add back to waitqueue |
t10                  |

After t6 but before t9, if new event happens, there'll be no wakeup
operation, and if user app has picked up this cqe in t7, read or write
until EAGAIN is returned. In t8, new event happens and will be lost,
though this race window maybe small.

To fix this possible race, add poll request back to waitqueue before
committing cqe.

Signed-off-by: Xiaoguang Wang <xiaoguang.wang@linux.alibaba.com>
---
 fs/io_uring.c | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 2bde732a1183..27608bad2276 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -5098,7 +5098,7 @@ static void io_poll_remove_double(struct io_kiocb *req)
 	}
 }
 
-static bool io_poll_complete(struct io_kiocb *req, __poll_t mask)
+static bool __io_poll_complete(struct io_kiocb *req, __poll_t mask)
 	__must_hold(&req->ctx->completion_lock)
 {
 	struct io_ring_ctx *ctx = req->ctx;
@@ -5120,10 +5120,19 @@ static bool io_poll_complete(struct io_kiocb *req, __poll_t mask)
 	if (flags & IORING_CQE_F_MORE)
 		ctx->cq_extra++;
 
-	io_commit_cqring(ctx);
 	return !(flags & IORING_CQE_F_MORE);
 }
 
+static inline bool io_poll_complete(struct io_kiocb *req, __poll_t mask)
+	__must_hold(&req->ctx->completion_lock)
+{
+	bool done;
+
+	done = __io_poll_complete(req, mask);
+	io_commit_cqring(req->ctx);
+	return done;
+}
+
 static void io_poll_task_func(struct io_kiocb *req, bool *locked)
 {
 	struct io_ring_ctx *ctx = req->ctx;
@@ -5134,7 +5143,7 @@ static void io_poll_task_func(struct io_kiocb *req, bool *locked)
 	} else {
 		bool done;
 
-		done = io_poll_complete(req, req->result);
+		done = __io_poll_complete(req, req->result);
 		if (done) {
 			io_poll_remove_double(req);
 			hash_del(&req->hash_node);
@@ -5142,6 +5151,7 @@ static void io_poll_task_func(struct io_kiocb *req, bool *locked)
 			req->result = 0;
 			add_wait_queue(req->poll.head, &req->poll.wait);
 		}
+		io_commit_cqring(ctx);
 		spin_unlock(&ctx->completion_lock);
 		io_cqring_ev_posted(ctx);
 
-- 
2.14.4.44.g2045bb6


^ permalink raw reply	[flat|nested] 2+ messages in thread

* Re: [RFC] io_uring: fix possible poll event lost in multi shot mode
  2021-09-02 14:48 [RFC] io_uring: fix possible poll event lost in multi shot mode Xiaoguang Wang
@ 2021-09-02 16:11 ` Jens Axboe
  0 siblings, 0 replies; 2+ messages in thread
From: Jens Axboe @ 2021-09-02 16:11 UTC (permalink / raw)
  To: Xiaoguang Wang, io-uring; +Cc: asml.silence

On 9/2/21 8:48 AM, Xiaoguang Wang wrote:
> IIUC, IORING_POLL_ADD_MULTI is similar to epoll's edge-triggered mode,
> that means once one pure poll request returns one event(cqe), we'll
> need to read or write continually until EAGAIN is returned, then I think
> there is a possible poll event lost race in multi shot mode:
> 
> t1  poll request add |                         |
> t2                   |                         |
> t3  event happens    |                         |
> t4  task work add    |                         |
> t5                   | task work run           |
> t6                   |   commit one cqe        |
> t7                   |                         | user app handles cqe
> t8                   |   new event happen      |
> t9                   |   add back to waitqueue |
> t10                  |
> 
> After t6 but before t9, if new event happens, there'll be no wakeup
> operation, and if user app has picked up this cqe in t7, read or write
> until EAGAIN is returned. In t8, new event happens and will be lost,
> though this race window maybe small.
> 
> To fix this possible race, add poll request back to waitqueue before
> committing cqe.

This looks sane to me. Probably just needs a:

Fixes: 88e41cf928a6 ("io_uring: add multishot mode for IORING_OP_POLL_ADD")

tag.

-- 
Jens Axboe


^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2021-09-02 16:30 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-09-02 14:48 [RFC] io_uring: fix possible poll event lost in multi shot mode Xiaoguang Wang
2021-09-02 16:11 ` Jens Axboe

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).