nagai/kernel
3
0
Fork 0
forked from mirrors/linux
Code Pull requests Activity

io_uring: fix deadlock on iowq file slot alloc

Browse source 
io_fixed_fd_install() can grab uring_lock in the slot allocation path
when called from io-wq, and then call into io_install_fixed_file(),
which will lock it again. Pull all locking out of
io_install_fixed_file() into io_fixed_fd_install().

Fixes: 1339f24b33 ("io_uring: allow allocated fixed files for openat/openat2")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/64116172a9d0b85b85300346bb280f3657aafc26.1654087283.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
This commit is contained in:
Pavel Begunkov 2022-06-01 15:28:44 +01:00 committed by Jens Axboe
parent a7c41b4687
commit 61c1b44a21
1 changed files with 16 additions and 22 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

34
fs/io_uring.c
View file

@ -5448,27 +5448,24 @@ static int io_fixed_fd_install(struct io_kiocb *req, unsigned int issue_flags,
struct io_ring_ctx *ctx = req->ctx; struct io_ring_ctx *ctx = req->ctx;
int ret; int ret;
if (alloc_slot) {
io_ring_submit_lock(ctx, issue_flags); io_ring_submit_lock(ctx, issue_flags);
ret = io_file_bitmap_get(ctx);
if (unlikely(ret < 0)) {
io_ring_submit_unlock(ctx, issue_flags);
fput(file);
return ret;
}
if (alloc_slot) {
ret = io_file_bitmap_get(ctx);
if (unlikely(ret < 0))
goto err;
file_slot = ret; file_slot = ret;
} else { } else {
file_slot--; file_slot--;
} }
ret = io_install_fixed_file(req, file, issue_flags, file_slot); ret = io_install_fixed_file(req, file, issue_flags, file_slot);
if (alloc_slot) { if (!ret && alloc_slot)
ret = file_slot;
err:
io_ring_submit_unlock(ctx, issue_flags); io_ring_submit_unlock(ctx, issue_flags);
if (!ret) if (unlikely(ret < 0))
return file_slot; fput(file);
}
return ret; return ret;
} }
@ -10179,21 +10176,19 @@ static int io_queue_rsrc_removal(struct io_rsrc_data *data, unsigned idx,
static int io_install_fixed_file(struct io_kiocb *req, struct file *file, static int io_install_fixed_file(struct io_kiocb *req, struct file *file,
unsigned int issue_flags, u32 slot_index) unsigned int issue_flags, u32 slot_index)
__must_hold(&req->ctx->uring_lock)
{ {
struct io_ring_ctx *ctx = req->ctx; struct io_ring_ctx *ctx = req->ctx;
bool needs_switch = false; bool needs_switch = false;
struct io_fixed_file *file_slot; struct io_fixed_file *file_slot;
int ret = -EBADF; int ret;
io_ring_submit_lock(ctx, issue_flags);
if (file->f_op == &io_uring_fops) if (file->f_op == &io_uring_fops)
goto err; return -EBADF;
ret = -ENXIO;
if (!ctx->file_data) if (!ctx->file_data)
goto err; return -ENXIO;
ret = -EINVAL;
if (slot_index >= ctx->nr_user_files) if (slot_index >= ctx->nr_user_files)
goto err; return -EINVAL;
slot_index = array_index_nospec(slot_index, ctx->nr_user_files); slot_index = array_index_nospec(slot_index, ctx->nr_user_files);
file_slot = io_fixed_file_slot(&ctx->file_table, slot_index); file_slot = io_fixed_file_slot(&ctx->file_table, slot_index);
@ -10224,7 +10219,6 @@ static int io_install_fixed_file(struct io_kiocb *req, struct file *file,
err: err:
if (needs_switch) if (needs_switch)
io_rsrc_node_switch(ctx, ctx->file_data); io_rsrc_node_switch(ctx, ctx->file_data);
io_ring_submit_unlock(ctx, issue_flags);
if (ret) if (ret)
fput(file); fput(file);
return ret; return ret;