1. 07 5月, 2020 3 次提交
  2. 05 5月, 2020 31 次提交
  3. 01 5月, 2020 6 次提交
    • P
      io_uring: punt splice async because of inode mutex · 2fb3e822
      Pavel Begunkov 提交于
      Nonblocking do_splice() still may wait for some time on an inode mutex.
      Let's play safe and always punt it async.
      Reported-by: NJens Axboe <axboe@kernel.dk>
      Signed-off-by: NPavel Begunkov <asml.silence@gmail.com>
      Signed-off-by: NJens Axboe <axboe@kernel.dk>
      2fb3e822
    • P
      io_uring: check non-sync defer_list carefully · 4ee36314
      Pavel Begunkov 提交于
      io_req_defer() do double-checked locking. Use proper helpers for that,
      i.e. list_empty_careful().
      Signed-off-by: NPavel Begunkov <asml.silence@gmail.com>
      Signed-off-by: NJens Axboe <axboe@kernel.dk>
      4ee36314
    • P
      io_uring: fix extra put in sync_file_range() · 7759a0bf
      Pavel Begunkov 提交于
      [   40.179474] refcount_t: underflow; use-after-free.
      [   40.179499] WARNING: CPU: 6 PID: 1848 at lib/refcount.c:28 refcount_warn_saturate+0xae/0xf0
      ...
      [   40.179612] RIP: 0010:refcount_warn_saturate+0xae/0xf0
      [   40.179617] Code: 28 44 0a 01 01 e8 d7 01 c2 ff 0f 0b 5d c3 80 3d 15 44 0a 01 00 75 91 48 c7 c7 b8 f5 75 be c6 05 05 44 0a 01 01 e8 b7 01 c2 ff <0f> 0b 5d c3 80 3d f3 43 0a 01 00 0f 85 6d ff ff ff 48 c7 c7 10 f6
      [   40.179619] RSP: 0018:ffffb252423ebe18 EFLAGS: 00010286
      [   40.179623] RAX: 0000000000000000 RBX: ffff98d65e929400 RCX: 0000000000000000
      [   40.179625] RDX: 0000000000000001 RSI: 0000000000000086 RDI: 00000000ffffffff
      [   40.179627] RBP: ffffb252423ebe18 R08: 0000000000000001 R09: 000000000000055d
      [   40.179629] R10: 0000000000000c8c R11: 0000000000000001 R12: 0000000000000000
      [   40.179631] R13: ffff98d68c434400 R14: ffff98d6a9cbaa20 R15: ffff98d6a609ccb8
      [   40.179634] FS:  0000000000000000(0000) GS:ffff98d6af580000(0000) knlGS:0000000000000000
      [   40.179636] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [   40.179638] CR2: 00000000033e3194 CR3: 000000006480a003 CR4: 00000000003606e0
      [   40.179641] Call Trace:
      [   40.179652]  io_put_req+0x36/0x40
      [   40.179657]  io_free_work+0x15/0x20
      [   40.179661]  io_worker_handle_work+0x2f5/0x480
      [   40.179667]  io_wqe_worker+0x2a9/0x360
      [   40.179674]  ? _raw_spin_unlock_irqrestore+0x24/0x40
      [   40.179681]  kthread+0x12c/0x170
      [   40.179685]  ? io_worker_handle_work+0x480/0x480
      [   40.179690]  ? kthread_park+0x90/0x90
      [   40.179695]  ret_from_fork+0x35/0x40
      [   40.179702] ---[ end trace 85027405f00110aa ]---
      
      Opcode handler must never put submission ref, but that's what
      io_sync_file_range_finish() do. use io_steal_work() there.
      Signed-off-by: NPavel Begunkov <asml.silence@gmail.com>
      Signed-off-by: NJens Axboe <axboe@kernel.dk>
      7759a0bf
    • X
      io_uring: use cond_resched() in io_ring_ctx_wait_and_kill() · 3fd44c86
      Xiaoguang Wang 提交于
      While working on to make io_uring sqpoll mode support syscalls that need
      struct files_struct, I got cpu soft lockup in io_ring_ctx_wait_and_kill(),
      
          while (ctx->sqo_thread && !wq_has_sleeper(&ctx->sqo_wait))
              cpu_relax();
      
      above loop never has an chance to exit, it's because preempt isn't enabled
      in the kernel, and the context calling io_ring_ctx_wait_and_kill() and
      io_sq_thread() run in the same cpu, if io_sq_thread calls a cond_resched()
      yield cpu and another context enters above loop, then io_sq_thread() will
      always in runqueue and never exit.
      
      Use cond_resched() can fix this issue.
      
       Reported-by: syzbot+66243bb7126c410cefe6@syzkaller.appspotmail.com
      Signed-off-by: NXiaoguang Wang <xiaoguang.wang@linux.alibaba.com>
      Signed-off-by: NJens Axboe <axboe@kernel.dk>
      3fd44c86
    • B
      io_uring: use proper references for fallback_req locking · dd461af6
      Bijan Mottahedeh 提交于
      Use ctx->fallback_req address for test_and_set_bit_lock() and
      clear_bit_unlock().
      Signed-off-by: NBijan Mottahedeh <bijan.mottahedeh@oracle.com>
      Signed-off-by: NJens Axboe <axboe@kernel.dk>
      dd461af6
    • J
      io_uring: only force async punt if poll based retry can't handle it · 490e8967
      Jens Axboe 提交于
      We do blocking retry from our poll handler, if the file supports polled
      notifications. Only mark the request as needing an async worker if we
      can't poll for it.
      Signed-off-by: NJens Axboe <axboe@kernel.dk>
      490e8967