mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-25 18:30:06 +00:00
io_uring: fix io_sqe_files_unregister() hangs
io_sqe_files_unregister() uninterruptibly waits for enqueued ref nodes, however requests keeping them may never complete, e.g. because of some userspace dependency. Make sure it's interruptible otherwise it would hang forever. Cc: stable@vger.kernel.org # 5.6+ Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
This commit is contained in:
parent
1642b4450d
commit
1ffc54220c
1 changed files with 22 additions and 2 deletions
|
@ -992,6 +992,10 @@ enum io_mem_account {
|
|||
ACCT_PINNED,
|
||||
};
|
||||
|
||||
static void destroy_fixed_file_ref_node(struct fixed_file_ref_node *ref_node);
|
||||
static struct fixed_file_ref_node *alloc_fixed_file_ref_node(
|
||||
struct io_ring_ctx *ctx);
|
||||
|
||||
static void __io_complete_rw(struct io_kiocb *req, long res, long res2,
|
||||
struct io_comp_state *cs);
|
||||
static void io_cqring_fill_event(struct io_kiocb *req, long res);
|
||||
|
@ -7244,11 +7248,15 @@ static void io_sqe_files_set_node(struct fixed_file_data *file_data,
|
|||
static int io_sqe_files_unregister(struct io_ring_ctx *ctx)
|
||||
{
|
||||
struct fixed_file_data *data = ctx->file_data;
|
||||
struct fixed_file_ref_node *ref_node = NULL;
|
||||
struct fixed_file_ref_node *backup_node, *ref_node = NULL;
|
||||
unsigned nr_tables, i;
|
||||
int ret;
|
||||
|
||||
if (!data)
|
||||
return -ENXIO;
|
||||
backup_node = alloc_fixed_file_ref_node(ctx);
|
||||
if (!backup_node)
|
||||
return -ENOMEM;
|
||||
|
||||
spin_lock_bh(&data->lock);
|
||||
ref_node = data->node;
|
||||
|
@ -7260,7 +7268,18 @@ static int io_sqe_files_unregister(struct io_ring_ctx *ctx)
|
|||
|
||||
/* wait for all refs nodes to complete */
|
||||
flush_delayed_work(&ctx->file_put_work);
|
||||
wait_for_completion(&data->done);
|
||||
do {
|
||||
ret = wait_for_completion_interruptible(&data->done);
|
||||
if (!ret)
|
||||
break;
|
||||
ret = io_run_task_work_sig();
|
||||
if (ret < 0) {
|
||||
percpu_ref_resurrect(&data->refs);
|
||||
reinit_completion(&data->done);
|
||||
io_sqe_files_set_node(data, backup_node);
|
||||
return ret;
|
||||
}
|
||||
} while (1);
|
||||
|
||||
__io_sqe_files_unregister(ctx);
|
||||
nr_tables = DIV_ROUND_UP(ctx->nr_user_files, IORING_MAX_FILES_TABLE);
|
||||
|
@ -7271,6 +7290,7 @@ static int io_sqe_files_unregister(struct io_ring_ctx *ctx)
|
|||
kfree(data);
|
||||
ctx->file_data = NULL;
|
||||
ctx->nr_user_files = 0;
|
||||
destroy_fixed_file_ref_node(backup_node);
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in a new issue