io_uring: pin ctx on fallback execution

isilence · axboe · commit 9cb0073b302a · 2021-08-17T16:06:14.000-06:00
Pin ring in io_fallback_req_func() by briefly elevating ctx->refs in case any task_work handler touches ctx after releasing a request. Fixes: 9011bf9 ("io_uring: fix stuck fallback reqs") Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Link: https://lore.kernel.org/r/833a494713d235ec144284a9bbfe418df4f6b61c.1629235576.git.asml.silence@gmail.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
diff --git a/fs/io_uring.c b/fs/io_uring.c
@@ -2477,8 +2477,10 @@ static void io_fallback_req_func(struct work_struct *work)
 	struct llist_node *node = llist_del_all(&ctx->fallback_llist);
 	struct io_kiocb *req, *tmp;
 
+	percpu_ref_get(&ctx->refs);
 	llist_for_each_entry_safe(req, tmp, node, io_task_work.fallback_node)
 		req->io_task_work.func(req);
+	percpu_ref_put(&ctx->refs);
 }
 
 static void __io_complete_rw(struct io_kiocb *req, long res, long res2,

Original file line number	Diff line number	Diff line change
`@@ -2477,8 +2477,10 @@ static void io_fallback_req_func(struct work_struct *work)`
`2477`	`2477`	`struct llist_node *node = llist_del_all(&ctx->fallback_llist);`
`2478`	`2478`	`struct io_kiocb req, tmp;`
`2479`	`2479`
	`2480`	`+ percpu_ref_get(&ctx->refs);`
`2480`	`2481`	`llist_for_each_entry_safe(req, tmp, node, io_task_work.fallback_node)`
`2481`	`2482`	`req->io_task_work.func(req);`
	`2483`	`+ percpu_ref_put(&ctx->refs);`
`2482`	`2484`	`}`
`2483`	`2485`
`2484`	`2486`	`static void __io_complete_rw(struct io_kiocb *req, long res, long res2,`