io_uring: break out of iowq iopoll on teardown

[ upstream commit 45500dc4e01c167ee063f3dcc22f51ced5b2b1e9 ]

io-wq will retry iopoll even when it failed with -EAGAIN. If that
races with task exit, which sets TIF_NOTIFY_SIGNAL for all its workers,
such workers might potentially infinitely spin retrying iopoll again and
again and each time failing on some allocation / waiting / etc. Don't
keep spinning if io-wq is dying.

Fixes: 561fb04a6a225 ("io_uring: replace workqueue usage with io-wq")
Cc: stable@vger.kernel.org
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/io_uring/io-wq.c b/io_uring/io-wq.c
index 81485c1a9879e14ae1b791284bce45adae3aa11c..fe8594a0396cae42953b5bdb7699309e76190332 100644 (file)
--- a/io_uring/io-wq.c
+++ b/io_uring/io-wq.c
@@ -176,6 +176,16 @@ static void io_worker_ref_put(struct io_wq *wq)
                complete(&wq->worker_done);
 }
 
+bool io_wq_worker_stopped(void)
+{
+       struct io_worker *worker = current->pf_io_worker;
+
+       if (WARN_ON_ONCE(!io_wq_current_is_worker()))
+               return true;
+
+       return test_bit(IO_WQ_BIT_EXIT, &worker->wqe->wq->state);
+}
+
 static void io_worker_cancel_cb(struct io_worker *worker)
 {
        struct io_wqe_acct *acct = io_wqe_get_acct(worker);

diff --git a/io_uring/io-wq.h b/io_uring/io-wq.h
index bf5c4c533760574f87d0cab165be2f4c60ecbff3..48721cbd5f40bf2ae9102b2b0f35c53670cc8548 100644 (file)
--- a/io_uring/io-wq.h
+++ b/io_uring/io-wq.h
@@ -129,6 +129,7 @@ void io_wq_hash_work(struct io_wq_work *work, void *val);
 
 int io_wq_cpu_affinity(struct io_wq *wq, cpumask_var_t mask);
 int io_wq_max_workers(struct io_wq *wq, int *new_count);
+bool io_wq_worker_stopped(void);
 
 static inline bool io_wq_is_hashed(struct io_wq_work *work)
 {

diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index fec6b6a409e7d4acae48cc977e227104466c675f..077c9527be37dd67c4b751cd705bffd430862c8b 100644 (file)
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -7069,7 +7069,8 @@ static void io_wq_submit_work(struct io_wq_work *work)
                         */
                        if (ret != -EAGAIN || !(req->ctx->flags & IORING_SETUP_IOPOLL))
                                break;
-
+                       if (io_wq_worker_stopped())
+                               break;
                        /*
                         * If REQ_F_NOWAIT is set, then don't wait or retry with
                         * poll. -EAGAIN is final for that case.