• Jens Axboe's avatar
    io_uring: ensure that SQPOLL thread is started for exit · 3ebba796
    Jens Axboe authored
    If we create it in a disabled state because IORING_SETUP_R_DISABLED is
    set on ring creation, we need to ensure that we've kicked the thread if
    we're exiting before it's been explicitly disabled. Otherwise we can run
    into a deadlock where exit is waiting go park the SQPOLL thread, but the
    SQPOLL thread itself is waiting to get a signal to start.
    
    That results in the below trace of both tasks hung, waiting on each other:
    
    INFO: task syz-executor458:8401 blocked for more than 143 seconds.
          Not tainted 5.11.0-next-20210226-syzkaller #0
    "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
    task:syz-executor458 state:D stack:27536 pid: 8401 ppid:  8400 flags:0x00004004
    Call Trace:
     context_switch kernel/sched/core.c:4324 [inline]
     __schedule+0x90c/0x21a0 kernel/sched/core.c:5075
     schedule+0xcf/0x270 kernel/sched/core.c:5154
     schedule_timeout+0x1db/0x250 kernel/time/timer.c:1868
     do_wait_for_common kernel/sched/completion.c:85 [inline]
     __wait_for_common kernel/sched/completion.c:106 [inline]
     wait_for_common kernel/sched/completion.c:117 [inline]
     wait_for_completion+0x168/0x270 kernel/sched/completion.c:138
     io_sq_thread_park fs/io_uring.c:7115 [inline]
     io_sq_thread_park+0xd5/0x130 fs/io_uring.c:7103
     io_uring_cancel_task_requests+0x24c/0xd90 fs/io_uring.c:8745
     __io_uring_files_cancel+0x110/0x230 fs/io_uring.c:8840
     io_uring_files_cancel include/linux/io_uring.h:47 [inline]
     do_exit+0x299/0x2a60 kernel/exit.c:780
     do_group_exit+0x125/0x310 kernel/exit.c:922
     __do_sys_exit_group kernel/exit.c:933 [inline]
     __se_sys_exit_group kernel/exit.c:931 [inline]
     __x64_sys_exit_group+0x3a/0x50 kernel/exit.c:931
     do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
     entry_SYSCALL_64_after_hwframe+0x44/0xae
    RIP: 0033:0x43e899
    RSP: 002b:00007ffe89376d48 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
    RAX: ffffffffffffffda RBX: 00000000004af2f0 RCX: 000000000043e899
    RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
    RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000010000000
    R10: 0000000000008011 R11: 0000000000000246 R12: 00000000004af2f0
    R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
    INFO: task iou-sqp-8401:8402 can't die for more than 143 seconds.
    task:iou-sqp-8401    state:D stack:30272 pid: 8402 ppid:  8400 flags:0x00004004
    Call Trace:
     context_switch kernel/sched/core.c:4324 [inline]
     __schedule+0x90c/0x21a0 kernel/sched/core.c:5075
     schedule+0xcf/0x270 kernel/sched/core.c:5154
     schedule_timeout+0x1db/0x250 kernel/time/timer.c:1868
     do_wait_for_common kernel/sched/completion.c:85 [inline]
     __wait_for_common kernel/sched/completion.c:106 [inline]
     wait_for_common kernel/sched/completion.c:117 [inline]
     wait_for_completion+0x168/0x270 kernel/sched/completion.c:138
     io_sq_thread+0x27d/0x1ae0 fs/io_uring.c:6717
     ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294
    INFO: task iou-sqp-8401:8402 blocked for more than 143 seconds.
    
    Reported-by: syzbot+fb5458330b4442f2090d@syzkaller.appspotmail.com
    Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
    3ebba796
io_uring.c 238 KB