Commit f254ac04 authored by Jens Axboe's avatar Jens Axboe

io_uring: enable lookup of links holding inflight files

When a process exits, we cancel whatever requests it has pending that
are referencing the file table. However, if a link is holding a
reference, then we cannot find it by simply looking at the inflight
list.

Enable checking of the poll and timeout list to find the link, and
cancel it appropriately.

Cc: stable@vger.kernel.org
Reported-by: default avatarJosef <josef.grieb@gmail.com>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent a36da65c
...@@ -4937,6 +4937,7 @@ static bool io_poll_remove_one(struct io_kiocb *req) ...@@ -4937,6 +4937,7 @@ static bool io_poll_remove_one(struct io_kiocb *req)
io_cqring_fill_event(req, -ECANCELED); io_cqring_fill_event(req, -ECANCELED);
io_commit_cqring(req->ctx); io_commit_cqring(req->ctx);
req->flags |= REQ_F_COMP_LOCKED; req->flags |= REQ_F_COMP_LOCKED;
req_set_fail_links(req);
io_put_req(req); io_put_req(req);
} }
...@@ -5109,6 +5110,23 @@ static enum hrtimer_restart io_timeout_fn(struct hrtimer *timer) ...@@ -5109,6 +5110,23 @@ static enum hrtimer_restart io_timeout_fn(struct hrtimer *timer)
return HRTIMER_NORESTART; return HRTIMER_NORESTART;
} }
static int __io_timeout_cancel(struct io_kiocb *req)
{
int ret;
list_del_init(&req->timeout.list);
ret = hrtimer_try_to_cancel(&req->io->timeout.timer);
if (ret == -1)
return -EALREADY;
req_set_fail_links(req);
req->flags |= REQ_F_COMP_LOCKED;
io_cqring_fill_event(req, -ECANCELED);
io_put_req(req);
return 0;
}
static int io_timeout_cancel(struct io_ring_ctx *ctx, __u64 user_data) static int io_timeout_cancel(struct io_ring_ctx *ctx, __u64 user_data)
{ {
struct io_kiocb *req; struct io_kiocb *req;
...@@ -5116,7 +5134,6 @@ static int io_timeout_cancel(struct io_ring_ctx *ctx, __u64 user_data) ...@@ -5116,7 +5134,6 @@ static int io_timeout_cancel(struct io_ring_ctx *ctx, __u64 user_data)
list_for_each_entry(req, &ctx->timeout_list, timeout.list) { list_for_each_entry(req, &ctx->timeout_list, timeout.list) {
if (user_data == req->user_data) { if (user_data == req->user_data) {
list_del_init(&req->timeout.list);
ret = 0; ret = 0;
break; break;
} }
...@@ -5125,15 +5142,7 @@ static int io_timeout_cancel(struct io_ring_ctx *ctx, __u64 user_data) ...@@ -5125,15 +5142,7 @@ static int io_timeout_cancel(struct io_ring_ctx *ctx, __u64 user_data)
if (ret == -ENOENT) if (ret == -ENOENT)
return ret; return ret;
ret = hrtimer_try_to_cancel(&req->io->timeout.timer); return __io_timeout_cancel(req);
if (ret == -1)
return -EALREADY;
req_set_fail_links(req);
req->flags |= REQ_F_COMP_LOCKED;
io_cqring_fill_event(req, -ECANCELED);
io_put_req(req);
return 0;
} }
static int io_timeout_remove_prep(struct io_kiocb *req, static int io_timeout_remove_prep(struct io_kiocb *req,
...@@ -7935,6 +7944,71 @@ static bool io_wq_files_match(struct io_wq_work *work, void *data) ...@@ -7935,6 +7944,71 @@ static bool io_wq_files_match(struct io_wq_work *work, void *data)
return work->files == files; return work->files == files;
} }
/*
* Returns true if 'preq' is the link parent of 'req'
*/
static bool io_match_link(struct io_kiocb *preq, struct io_kiocb *req)
{
struct io_kiocb *link;
if (!(preq->flags & REQ_F_LINK_HEAD))
return false;
list_for_each_entry(link, &preq->link_list, link_list) {
if (link == req)
return true;
}
return false;
}
/*
* We're looking to cancel 'req' because it's holding on to our files, but
* 'req' could be a link to another request. See if it is, and cancel that
* parent request if so.
*/
static bool io_poll_remove_link(struct io_ring_ctx *ctx, struct io_kiocb *req)
{
struct hlist_node *tmp;
struct io_kiocb *preq;
bool found = false;
int i;
spin_lock_irq(&ctx->completion_lock);
for (i = 0; i < (1U << ctx->cancel_hash_bits); i++) {
struct hlist_head *list;
list = &ctx->cancel_hash[i];
hlist_for_each_entry_safe(preq, tmp, list, hash_node) {
found = io_match_link(preq, req);
if (found) {
io_poll_remove_one(preq);
break;
}
}
}
spin_unlock_irq(&ctx->completion_lock);
return found;
}
static bool io_timeout_remove_link(struct io_ring_ctx *ctx,
struct io_kiocb *req)
{
struct io_kiocb *preq;
bool found = false;
spin_lock_irq(&ctx->completion_lock);
list_for_each_entry(preq, &ctx->timeout_list, timeout.list) {
found = io_match_link(preq, req);
if (found) {
__io_timeout_cancel(preq);
break;
}
}
spin_unlock_irq(&ctx->completion_lock);
return found;
}
static void io_uring_cancel_files(struct io_ring_ctx *ctx, static void io_uring_cancel_files(struct io_ring_ctx *ctx,
struct files_struct *files) struct files_struct *files)
{ {
...@@ -7989,6 +8063,9 @@ static void io_uring_cancel_files(struct io_ring_ctx *ctx, ...@@ -7989,6 +8063,9 @@ static void io_uring_cancel_files(struct io_ring_ctx *ctx,
} }
} else { } else {
io_wq_cancel_work(ctx->io_wq, &cancel_req->work); io_wq_cancel_work(ctx->io_wq, &cancel_req->work);
/* could be a link, check and remove if it is */
if (!io_poll_remove_link(ctx, cancel_req))
io_timeout_remove_link(ctx, cancel_req);
io_put_req(cancel_req); io_put_req(cancel_req);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment