Skip to content

Commit 509b5b1

Browse files
torvaldstorvalds
committed
Merge tag 'io_uring-6.19-20260102' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull io_uring fixes from Jens Axboe: - Removed dead argument length for io_uring_validate_mmap_request() - Use GFP_NOWAIT for overflow CQEs on legacy ring setups rather than GFP_ATOMIC, which makes it play nicer with memcg limits - Fix a potential circular locking issue with tctx node removal and exec based cancelations * tag 'io_uring-6.19-20260102' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring/memmap: drop unused sz param in io_uring_validate_mmap_request() io_uring/tctx: add separate lock for list of tctx's in ctx io_uring: use GFP_NOWAIT for overflow CQEs on legacy rings
2 parents 71b62ed + 70eafc7 commit 509b5b1

6 files changed

Lines changed: 28 additions & 11 deletions

File tree

‎include/linux/io_uring_types.h‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -424,11 +424,17 @@ struct io_ring_ctx {
424424
struct user_struct *user;
425425
struct mm_struct *mm_account;
426426

427+
/*
428+
* List of tctx nodes for this ctx, protected by tctx_lock. For
429+
* cancelation purposes, nests under uring_lock.
430+
*/
431+
struct list_head tctx_list;
432+
struct mutex tctx_lock;
433+
427434
/* ctx exit and cancelation */
428435
struct llist_head fallback_llist;
429436
struct delayed_work fallback_work;
430437
struct work_struct exit_work;
431-
struct list_head tctx_list;
432438
struct completion ref_comp;
433439

434440
/* io-wq management, e.g. thread count */

‎io_uring/cancel.c‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -184,7 +184,9 @@ static int __io_async_cancel(struct io_cancel_data *cd,
184184
} while (1);
185185

186186
/* slow path, try all io-wq's */
187+
__set_current_state(TASK_RUNNING);
187188
io_ring_submit_lock(ctx, issue_flags);
189+
mutex_lock(&ctx->tctx_lock);
188190
ret = -ENOENT;
189191
list_for_each_entry(node, &ctx->tctx_list, ctx_node) {
190192
ret = io_async_cancel_one(node->task->io_uring, cd);
@@ -194,6 +196,7 @@ static int __io_async_cancel(struct io_cancel_data *cd,
194196
nr++;
195197
}
196198
}
199+
mutex_unlock(&ctx->tctx_lock);
197200
io_ring_submit_unlock(ctx, issue_flags);
198201
return all ? nr : ret;
199202
}
@@ -484,6 +487,7 @@ static __cold bool io_uring_try_cancel_iowq(struct io_ring_ctx *ctx)
484487
bool ret = false;
485488

486489
mutex_lock(&ctx->uring_lock);
490+
mutex_lock(&ctx->tctx_lock);
487491
list_for_each_entry(node, &ctx->tctx_list, ctx_node) {
488492
struct io_uring_task *tctx = node->task->io_uring;
489493

@@ -496,6 +500,7 @@ static __cold bool io_uring_try_cancel_iowq(struct io_ring_ctx *ctx)
496500
cret = io_wq_cancel_cb(tctx->io_wq, io_cancel_ctx_cb, ctx, true);
497501
ret |= (cret != IO_WQ_CANCEL_NOTFOUND);
498502
}
503+
mutex_unlock(&ctx->tctx_lock);
499504
mutex_unlock(&ctx->uring_lock);
500505

501506
return ret;

‎io_uring/io_uring.c‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -340,6 +340,7 @@ static __cold struct io_ring_ctx *io_ring_ctx_alloc(struct io_uring_params *p)
340340
INIT_LIST_HEAD(&ctx->ltimeout_list);
341341
init_llist_head(&ctx->work_llist);
342342
INIT_LIST_HEAD(&ctx->tctx_list);
343+
mutex_init(&ctx->tctx_lock);
343344
ctx->submit_state.free_list.next = NULL;
344345
INIT_HLIST_HEAD(&ctx->waitid_list);
345346
xa_init_flags(&ctx->zcrx_ctxs, XA_FLAGS_ALLOC);
@@ -864,7 +865,7 @@ static __cold bool io_cqe_overflow_locked(struct io_ring_ctx *ctx,
864865
{
865866
struct io_overflow_cqe *ocqe;
866867

867-
ocqe = io_alloc_ocqe(ctx, cqe, big_cqe, GFP_ATOMIC);
868+
ocqe = io_alloc_ocqe(ctx, cqe, big_cqe, GFP_NOWAIT);
868869
return io_cqring_add_overflow(ctx, ocqe);
869870
}
870871

@@ -3045,6 +3046,7 @@ static __cold void io_ring_exit_work(struct work_struct *work)
30453046
exit.ctx = ctx;
30463047

30473048
mutex_lock(&ctx->uring_lock);
3049+
mutex_lock(&ctx->tctx_lock);
30483050
while (!list_empty(&ctx->tctx_list)) {
30493051
WARN_ON_ONCE(time_after(jiffies, timeout));
30503052

@@ -3056,6 +3058,7 @@ static __cold void io_ring_exit_work(struct work_struct *work)
30563058
if (WARN_ON_ONCE(ret))
30573059
continue;
30583060

3061+
mutex_unlock(&ctx->tctx_lock);
30593062
mutex_unlock(&ctx->uring_lock);
30603063
/*
30613064
* See comment above for
@@ -3064,7 +3067,9 @@ static __cold void io_ring_exit_work(struct work_struct *work)
30643067
*/
30653068
wait_for_completion_interruptible(&exit.completion);
30663069
mutex_lock(&ctx->uring_lock);
3070+
mutex_lock(&ctx->tctx_lock);
30673071
}
3072+
mutex_unlock(&ctx->tctx_lock);
30683073
mutex_unlock(&ctx->uring_lock);
30693074
spin_lock(&ctx->completion_lock);
30703075
spin_unlock(&ctx->completion_lock);

‎io_uring/memmap.c‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -268,8 +268,7 @@ static void *io_region_validate_mmap(struct io_ring_ctx *ctx,
268268
return io_region_get_ptr(mr);
269269
}
270270

271-
static void *io_uring_validate_mmap_request(struct file *file, loff_t pgoff,
272-
size_t sz)
271+
static void *io_uring_validate_mmap_request(struct file *file, loff_t pgoff)
273272
{
274273
struct io_ring_ctx *ctx = file->private_data;
275274
struct io_mapped_region *region;
@@ -304,7 +303,7 @@ __cold int io_uring_mmap(struct file *file, struct vm_area_struct *vma)
304303

305304
guard(mutex)(&ctx->mmap_lock);
306305

307-
ptr = io_uring_validate_mmap_request(file, vma->vm_pgoff, sz);
306+
ptr = io_uring_validate_mmap_request(file, vma->vm_pgoff);
308307
if (IS_ERR(ptr))
309308
return PTR_ERR(ptr);
310309

@@ -336,7 +335,7 @@ unsigned long io_uring_get_unmapped_area(struct file *filp, unsigned long addr,
336335

337336
guard(mutex)(&ctx->mmap_lock);
338337

339-
ptr = io_uring_validate_mmap_request(filp, pgoff, len);
338+
ptr = io_uring_validate_mmap_request(filp, pgoff);
340339
if (IS_ERR(ptr))
341340
return -ENOMEM;
342341

@@ -386,7 +385,7 @@ unsigned long io_uring_get_unmapped_area(struct file *file, unsigned long addr,
386385

387386
guard(mutex)(&ctx->mmap_lock);
388387

389-
ptr = io_uring_validate_mmap_request(file, pgoff, len);
388+
ptr = io_uring_validate_mmap_request(file, pgoff);
390389
if (IS_ERR(ptr))
391390
return PTR_ERR(ptr);
392391

‎io_uring/register.c‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -320,6 +320,7 @@ static __cold int io_register_iowq_max_workers(struct io_ring_ctx *ctx,
320320
return 0;
321321

322322
/* now propagate the restriction to all registered users */
323+
mutex_lock(&ctx->tctx_lock);
323324
list_for_each_entry(node, &ctx->tctx_list, ctx_node) {
324325
tctx = node->task->io_uring;
325326
if (WARN_ON_ONCE(!tctx->io_wq))
@@ -330,6 +331,7 @@ static __cold int io_register_iowq_max_workers(struct io_ring_ctx *ctx,
330331
/* ignore errors, it always returns zero anyway */
331332
(void)io_wq_max_workers(tctx->io_wq, new_count);
332333
}
334+
mutex_unlock(&ctx->tctx_lock);
333335
return 0;
334336
err:
335337
if (sqd) {

‎io_uring/tctx.c‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -136,9 +136,9 @@ int __io_uring_add_tctx_node(struct io_ring_ctx *ctx)
136136
return ret;
137137
}
138138

139-
mutex_lock(&ctx->uring_lock);
139+
mutex_lock(&ctx->tctx_lock);
140140
list_add(&node->ctx_node, &ctx->tctx_list);
141-
mutex_unlock(&ctx->uring_lock);
141+
mutex_unlock(&ctx->tctx_lock);
142142
}
143143
return 0;
144144
}
@@ -176,9 +176,9 @@ __cold void io_uring_del_tctx_node(unsigned long index)
176176
WARN_ON_ONCE(current != node->task);
177177
WARN_ON_ONCE(list_empty(&node->ctx_node));
178178

179-
mutex_lock(&node->ctx->uring_lock);
179+
mutex_lock(&node->ctx->tctx_lock);
180180
list_del(&node->ctx_node);
181-
mutex_unlock(&node->ctx->uring_lock);
181+
mutex_unlock(&node->ctx->tctx_lock);
182182

183183
if (tctx->last == node->ctx)
184184
tctx->last = NULL;

0 commit comments

Comments
 (0)