diff options
| author | Jens Axboe <axboe@kernel.dk> | 2021-12-09 18:54:29 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-12-14 12:57:15 +0300 |
| commit | 8e12976c0c19ebc14b60046b1348c516a74c25a2 (patch) | |
| tree | 5667ab64ca5b984b7b8e2a24f42a4e243396164d /fs/io_uring.c | |
| parent | eb313c47b2762565d48627d49ce661ae5018d155 (diff) | |
| download | linux-8e12976c0c19ebc14b60046b1348c516a74c25a2.tar.xz | |
io_uring: ensure task_work gets run as part of cancelations
commit 78a780602075d8b00c98070fa26e389b3b3efa72 upstream.
If we successfully cancel a work item but that work item needs to be
processed through task_work, then we can be sleeping uninterruptibly
in io_uring_cancel_generic() and never process it. Hence we don't
make forward progress and we end up with an uninterruptible sleep
warning.
While in there, correct a comment that should be IFF, not IIF.
Reported-and-tested-by: syzbot+21e6887c0be14181206d@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'fs/io_uring.c')
| -rw-r--r-- | fs/io_uring.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/fs/io_uring.c b/fs/io_uring.c index f8ceddafb6fc..e9b06e339c4b 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -9775,7 +9775,7 @@ static void io_uring_drop_tctx_refs(struct task_struct *task) /* * Find any io_uring ctx that this task has registered or done IO on, and cancel - * requests. @sqd should be not-null IIF it's an SQPOLL thread cancellation. + * requests. @sqd should be not-null IFF it's an SQPOLL thread cancellation. */ static void io_uring_cancel_generic(bool cancel_all, struct io_sq_data *sqd) { @@ -9816,8 +9816,10 @@ static void io_uring_cancel_generic(bool cancel_all, struct io_sq_data *sqd) cancel_all); } - prepare_to_wait(&tctx->wait, &wait, TASK_UNINTERRUPTIBLE); + prepare_to_wait(&tctx->wait, &wait, TASK_INTERRUPTIBLE); + io_run_task_work(); io_uring_drop_tctx_refs(current); + /* * If we've seen completions, retry without waiting. This * avoids a race where a completion comes in before we did |