From: Pavel Begunkov <asml.silence@gmail.com>
To: Jens Axboe <axboe@kernel.dk>, io-uring@vger.kernel.org
Subject: [PATCH 1/5] io_uring: don't set COMP_LOCKED if won't put
Date: Tue, 13 Oct 2020 09:43:56 +0100 [thread overview]
Message-ID: <afbaf7d6b575eab0ddf76ad26e82feeeb46205c7.1602577875.git.asml.silence@gmail.com> (raw)
In-Reply-To: <cover.1602577875.git.asml.silence@gmail.com>
__io_kill_linked_timeout() sets REQ_F_COMP_LOCKED for a linked timeout
even if it can't cancel it, e.g. it's already running. It not only races
with io_link_timeout_fn() for ->flags field, but also leaves the flag
set and so io_link_timeout_fn() may find it and decide that it holds the
lock. Hopefully, the second problem is potential.
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
---
fs/io_uring.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/io_uring.c b/fs/io_uring.c
index bbac9a40f42c..e73f63b57e0b 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -1778,6 +1778,7 @@ static bool io_link_cancel_timeout(struct io_kiocb *req)
ret = hrtimer_try_to_cancel(&io->timer);
if (ret != -1) {
+ req->flags |= REQ_F_COMP_LOCKED;
io_cqring_fill_event(req, -ECANCELED);
io_commit_cqring(ctx);
req->flags &= ~REQ_F_LINK_HEAD;
@@ -1800,7 +1801,6 @@ static bool __io_kill_linked_timeout(struct io_kiocb *req)
return false;
list_del_init(&link->link_list);
- link->flags |= REQ_F_COMP_LOCKED;
wake_ev = io_link_cancel_timeout(link);
req->flags &= ~REQ_F_LINK_TIMEOUT;
return wake_ev;
--
2.24.0
next prev parent reply other threads:[~2020-10-13 8:46 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-10-13 8:43 [PATCH 0/5] fixes for REQ_F_COMP_LOCKED Pavel Begunkov
2020-10-13 8:43 ` Pavel Begunkov [this message]
2020-10-13 8:43 ` [PATCH 2/5] io_uring: don't unnecessarily clear F_LINK_TIMEOUT Pavel Begunkov
2020-10-13 8:43 ` [PATCH 3/5] io_uring: don't put a poll req under spinlock Pavel Begunkov
2020-10-13 14:54 ` Jens Axboe
2020-10-13 8:43 ` [PATCH 4/5] io_uring: dig out COMP_LOCK from deep call chain Pavel Begunkov
2020-10-13 8:44 ` [PATCH 5/5] io_uring: fix REQ_F_COMP_LOCKED by killing it Pavel Begunkov
2020-10-13 9:46 ` [PATCH 0/5] fixes for REQ_F_COMP_LOCKED Pavel Begunkov
2020-10-13 14:57 ` Jens Axboe
2020-10-13 17:02 ` Pavel Begunkov
2020-10-13 15:14 ` Jens Axboe
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=afbaf7d6b575eab0ddf76ad26e82feeeb46205c7.1602577875.git.asml.silence@gmail.com \
--to=asml.silence@gmail.com \
--cc=axboe@kernel.dk \
--cc=io-uring@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).