[RFC,net-next,v3,1/1] io_uring: fix deadlock on iowq file slot alloc

Commit Message

Pavel Begunkov June 1, 2022, 2:28 p.m. UTC

io_fixed_fd_install() can grab uring_lock in the slot allocation path
when called from io-wq, and then call into io_install_fixed_file(),
which will lock it again. Pull all locking out of
io_install_fixed_file() into io_fixed_fd_install().

Fixes: 1339f24b336db ("io_uring: allow allocated fixed files for openat/openat2")
Signed-off-by: Pavel Begunkov <[e-mail]>
---
 fs/io_uring.c | 33 +++++++++++++--------------------
 1 file changed, 13 insertions(+), 20 deletions(-)

Comments

Jens Axboe June 1, 2022, 4:29 p.m. UTC | #1

On 6/1/22 8:28 AM, Pavel Begunkov wrote:
> io_fixed_fd_install() can grab uring_lock in the slot allocation path
> when called from io-wq, and then call into io_install_fixed_file(),
> which will lock it again. Pull all locking out of
> io_install_fixed_file() into io_fixed_fd_install().

Subject was a little funky for this one, and I had to hand-apply it
since the base was missing that fput fix.

Can you check the end result:

https://git.kernel.dk/cgit/linux-block/commit/?h=io_uring-5.19&id=61c1b44a21d70d4783db02198fbf68b132f4953c

Patch

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 78990a130b66..051586a5371b 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -5791,26 +5791,22 @@  static int io_fixed_fd_install(struct io_kiocb *req, unsigned int issue_flags,
 	struct io_ring_ctx *ctx = req->ctx;
 	int ret;
 
+	io_ring_submit_lock(ctx, issue_flags);
+
 	if (alloc_slot) {
-		io_ring_submit_lock(ctx, issue_flags);
 		ret = io_file_bitmap_get(ctx);
-		if (unlikely(ret < 0)) {
-			io_ring_submit_unlock(ctx, issue_flags);
-			return ret;
-		}
-
+		if (unlikely(ret < 0))
+			goto err;
 		file_slot = ret;
 	} else {
 		file_slot--;
 	}
 
 	ret = io_install_fixed_file(req, file, issue_flags, file_slot);
-	if (alloc_slot) {
-		io_ring_submit_unlock(ctx, issue_flags);
-		if (!ret)
-			return file_slot;
-	}
-
+	if (!ret && alloc_slot)
+		ret = file_slot;
+err:
+	io_ring_submit_unlock(ctx, issue_flags);
 	return ret;
 }
 
@@ -10663,21 +10659,19 @@  static int io_queue_rsrc_removal(struct io_rsrc_data *data, unsigned idx,
 
 static int io_install_fixed_file(struct io_kiocb *req, struct file *file,
 				 unsigned int issue_flags, u32 slot_index)
+	__must_hold(&req->ctx->uring_lock)
 {
 	struct io_ring_ctx *ctx = req->ctx;
 	bool needs_switch = false;
 	struct io_fixed_file *file_slot;
-	int ret = -EBADF;
+	int ret;
 
-	io_ring_submit_lock(ctx, issue_flags);
 	if (file->f_op == &io_uring_fops)
-		goto err;
-	ret = -ENXIO;
+		return -EBADF;
 	if (!ctx->file_data)
-		goto err;
-	ret = -EINVAL;
+		return -ENXIO;
 	if (slot_index >= ctx->nr_user_files)
-		goto err;
+		return -EINVAL;
 
 	slot_index = array_index_nospec(slot_index, ctx->nr_user_files);
 	file_slot = io_fixed_file_slot(&ctx->file_table, slot_index);
@@ -10708,7 +10702,6 @@  static int io_install_fixed_file(struct io_kiocb *req, struct file *file,
 err:
 	if (needs_switch)
 		io_rsrc_node_switch(ctx, ctx->file_data);
-	io_ring_submit_unlock(ctx, issue_flags);
 	if (ret)
 		fput(file);
 	return ret;