1. 22 2月, 2020 2 次提交
    • X
      io_uring: fix __io_iopoll_check deadlock in io_sq_thread · c7849be9
      Xiaoguang Wang 提交于
      Since commit a3a0e43f ("io_uring: don't enter poll loop if we have
      CQEs pending"), if we already events pending, we won't enter poll loop.
      In case SETUP_IOPOLL and SETUP_SQPOLL are both enabled, if app has
      been terminated and don't reap pending events which are already in cq
      ring, and there are some reqs in poll_list, io_sq_thread will enter
      __io_iopoll_check(), and find pending events, then return, this loop
      will never have a chance to exit.
      
      I have seen this issue in fio stress tests, to fix this issue, let
      io_sq_thread call io_iopoll_getevents() with argument 'min' being zero,
      and remove __io_iopoll_check().
      
      Fixes: a3a0e43f ("io_uring: don't enter poll loop if we have CQEs pending")
      Signed-off-by: NXiaoguang Wang <xiaoguang.wang@linux.alibaba.com>
      Signed-off-by: NJens Axboe <axboe@kernel.dk>
      c7849be9
    • S
      io_uring: prevent sq_thread from spinning when it should stop · 7143b5ac
      Stefano Garzarella 提交于
      This patch drops 'cur_mm' before calling cond_resched(), to prevent
      the sq_thread from spinning even when the user process is finished.
      
      Before this patch, if the user process ended without closing the
      io_uring fd, the sq_thread continues to spin until the
      'sq_thread_idle' timeout ends.
      
      In the worst case where the 'sq_thread_idle' parameter is bigger than
      INT_MAX, the sq_thread will spin forever.
      
      Fixes: 6c271ce2 ("io_uring: add submission polling")
      Signed-off-by: NStefano Garzarella <sgarzare@redhat.com>
      Signed-off-by: NJens Axboe <axboe@kernel.dk>
      7143b5ac
  2. 19 2月, 2020 2 次提交
  3. 17 2月, 2020 1 次提交
  4. 14 2月, 2020 1 次提交
    • J
      io_uring: prune request from overflow list on flush · 2ca10259
      Jens Axboe 提交于
      Carter reported an issue where he could produce a stall on ring exit,
      when we're cleaning up requests that match the given file table. For
      this particular test case, a combination of a few things caused the
      issue:
      
      - The cq ring was overflown
      - The request being canceled was in the overflow list
      
      The combination of the above means that the cq overflow list holds a
      reference to the request. The request is canceled correctly, but since
      the overflow list holds a reference to it, the final put won't happen.
      Since the final put doesn't happen, the request remains in the inflight.
      Hence we never finish the cancelation flush.
      
      Fix this by removing requests from the overflow list if we're canceling
      them.
      
      Cc: stable@vger.kernel.org # 5.5
      Reported-by: NCarter Li 李通洲 <carter.li@eoitek.com>
      Signed-off-by: NJens Axboe <axboe@kernel.dk>
      2ca10259
  5. 10 2月, 2020 2 次提交
  6. 09 2月, 2020 11 次提交
  7. 07 2月, 2020 3 次提交
    • P
      io_uring: fix deferred req iovec leak · 1e95081c
      Pavel Begunkov 提交于
      After defer, a request will be prepared, that includes allocating iovec
      if needed, and then submitted through io_wq_submit_work() but not custom
      handler (e.g. io_rw_async()/io_sendrecv_async()). However, it'll leak
      iovec, as it's in io-wq and the code goes as follows:
      
      io_read() {
      	if (!io_wq_current_is_worker())
      		kfree(iovec);
      }
      
      Put all deallocation logic in io_{read,write,send,recv}(), which will
      leave the memory, if going async with -EAGAIN.
      
      It also fixes a leak after failed io_alloc_async_ctx() in
      io_{recv,send}_msg().
      
      Cc: stable@vger.kernel.org # 5.5
      Signed-off-by: NPavel Begunkov <asml.silence@gmail.com>
      Signed-off-by: NJens Axboe <axboe@kernel.dk>
      1e95081c
    • R
      io_uring: fix 1-bit bitfields to be unsigned · e1d85334
      Randy Dunlap 提交于
      Make bitfields of size 1 bit be unsigned (since there is no room
      for the sign bit).
      This clears up the sparse warnings:
      
        CHECK   ../fs/io_uring.c
      ../fs/io_uring.c:207:50: error: dubious one-bit signed bitfield
      ../fs/io_uring.c:208:55: error: dubious one-bit signed bitfield
      ../fs/io_uring.c:209:63: error: dubious one-bit signed bitfield
      ../fs/io_uring.c:210:54: error: dubious one-bit signed bitfield
      ../fs/io_uring.c:211:57: error: dubious one-bit signed bitfield
      
      Found by sight and then verified with sparse.
      
      Fixes: 69b3e546 ("io_uring: change io_ring_ctx bool fields into bit fields")
      Signed-off-by: NRandy Dunlap <rdunlap@infradead.org>
      Cc: Jens Axboe <axboe@kernel.dk>
      Cc: io-uring@vger.kernel.org
      Signed-off-by: NJens Axboe <axboe@kernel.dk>
      e1d85334
    • P
      io_uring: get rid of delayed mm check · 1cb1edb2
      Pavel Begunkov 提交于
      Fail fast if can't grab mm, so past that requests always have an mm
      when required. This allows us to remove req->user altogether.
      Signed-off-by: NPavel Begunkov <asml.silence@gmail.com>
      Signed-off-by: NJens Axboe <axboe@kernel.dk>
      1cb1edb2
  8. 05 2月, 2020 2 次提交
    • J
      io_uring: cleanup fixed file data table references · 2faf852d
      Jens Axboe 提交于
      syzbot reports a use-after-free in io_ring_file_ref_switch() when it
      tries to switch back to percpu mode. When we put the final reference to
      the table by calling percpu_ref_kill_and_confirm(), we don't want the
      zero reference to queue async work for flushing the potentially queued
      up items. We currently do a few flush_work(), but they merely paper
      around the issue, since the work item may not have been queued yet
      depending on the when the percpu-ref callback gets run.
      
      Coming into the file unregister, we know we have the ring quiesced.
      io_ring_file_ref_switch() can check for whether or not the ref is dying
      or not, and not queue anything async at that point. Once the ref has
      been confirmed killed, flush any potential items manually.
      
      Reported-by: syzbot+7caeaea49c2c8a591e3d@syzkaller.appspotmail.com
      Fixes: 05f3fb3c ("io_uring: avoid ring quiesce for fixed file set unregister and update")
      Signed-off-by: NJens Axboe <axboe@kernel.dk>
      2faf852d
    • J
      io_uring: spin for sq thread to idle on shutdown · df069d80
      Jens Axboe 提交于
      As part of io_uring shutdown, we cancel work that is pending and won't
      necessarily complete on its own. That includes requests like poll
      commands and timeouts.
      
      If we're using SQPOLL for kernel side submission and we shutdown the
      ring immediately after queueing such work, we can race with the sqthread
      doing the submission. This means we may miss cancelling some work, which
      results in the io_uring shutdown hanging forever.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: NJens Axboe <axboe@kernel.dk>
      df069d80
  9. 04 2月, 2020 8 次提交
  10. 01 2月, 2020 2 次提交
    • J
      mm, tree-wide: rename put_user_page*() to unpin_user_page*() · f1f6a7dd
      John Hubbard 提交于
      In order to provide a clearer, more symmetric API for pinning and
      unpinning DMA pages.  This way, pin_user_pages*() calls match up with
      unpin_user_pages*() calls, and the API is a lot closer to being
      self-explanatory.
      
      Link: http://lkml.kernel.org/r/20200107224558.2362728-23-jhubbard@nvidia.comSigned-off-by: NJohn Hubbard <jhubbard@nvidia.com>
      Reviewed-by: NJan Kara <jack@suse.cz>
      Cc: Alex Williamson <alex.williamson@redhat.com>
      Cc: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
      Cc: Björn Töpel <bjorn.topel@intel.com>
      Cc: Christoph Hellwig <hch@lst.de>
      Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
      Cc: Dan Williams <dan.j.williams@intel.com>
      Cc: Hans Verkuil <hverkuil-cisco@xs4all.nl>
      Cc: Ira Weiny <ira.weiny@intel.com>
      Cc: Jason Gunthorpe <jgg@mellanox.com>
      Cc: Jason Gunthorpe <jgg@ziepe.ca>
      Cc: Jens Axboe <axboe@kernel.dk>
      Cc: Jerome Glisse <jglisse@redhat.com>
      Cc: Jonathan Corbet <corbet@lwn.net>
      Cc: Kirill A. Shutemov <kirill@shutemov.name>
      Cc: Leon Romanovsky <leonro@mellanox.com>
      Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
      Cc: Mike Rapoport <rppt@linux.ibm.com>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      f1f6a7dd
    • J
      fs/io_uring: set FOLL_PIN via pin_user_pages() · 2113b05d
      John Hubbard 提交于
      Convert fs/io_uring to use the new pin_user_pages() call, which sets
      FOLL_PIN.  Setting FOLL_PIN is now required for code that requires
      tracking of pinned pages, and therefore for any code that calls
      put_user_page().
      
      In partial anticipation of this work, the io_uring code was already
      calling put_user_page() instead of put_page().  Therefore, in order to
      convert from the get_user_pages()/put_page() model, to the
      pin_user_pages()/put_user_page() model, the only change required here is
      to change get_user_pages() to pin_user_pages().
      
      Link: http://lkml.kernel.org/r/20200107224558.2362728-17-jhubbard@nvidia.comSigned-off-by: NJohn Hubbard <jhubbard@nvidia.com>
      Reviewed-by: NJens Axboe <axboe@kernel.dk>
      Reviewed-by: NJan Kara <jack@suse.cz>
      Cc: Alex Williamson <alex.williamson@redhat.com>
      Cc: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
      Cc: Björn Töpel <bjorn.topel@intel.com>
      Cc: Christoph Hellwig <hch@lst.de>
      Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
      Cc: Dan Williams <dan.j.williams@intel.com>
      Cc: Hans Verkuil <hverkuil-cisco@xs4all.nl>
      Cc: Ira Weiny <ira.weiny@intel.com>
      Cc: Jason Gunthorpe <jgg@mellanox.com>
      Cc: Jason Gunthorpe <jgg@ziepe.ca>
      Cc: Jerome Glisse <jglisse@redhat.com>
      Cc: Jonathan Corbet <corbet@lwn.net>
      Cc: Kirill A. Shutemov <kirill@shutemov.name>
      Cc: Leon Romanovsky <leonro@mellanox.com>
      Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
      Cc: Mike Rapoport <rppt@linux.ibm.com>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      2113b05d
  11. 31 1月, 2020 2 次提交
  12. 30 1月, 2020 2 次提交
    • J
      io_uring: add support for epoll_ctl(2) · 3e4827b0
      Jens Axboe 提交于
      This adds IORING_OP_EPOLL_CTL, which can perform the same work as the
      epoll_ctl(2) system call.
      Signed-off-by: NJens Axboe <axboe@kernel.dk>
      3e4827b0
    • J
      io_uring: fix linked command file table usage · f86cd20c
      Jens Axboe 提交于
      We're not consistent in how the file table is grabbed and assigned if we
      have a command linked that requires the use of it.
      
      Add ->file_table to the io_op_defs[] array, and use that to determine
      when to grab the table instead of having the handlers set it if they
      need to defer. This also means we can kill the IO_WQ_WORK_NEEDS_FILES
      flag. We always initialize work->files, so io-wq can just check for
      that.
      Signed-off-by: NJens Axboe <axboe@kernel.dk>
      f86cd20c
  13. 29 1月, 2020 2 次提交
新手
引导
客服 返回
顶部