Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: Re: INFO: task hung in io_sq_thread_stop
To:     Hillf Danton <hdanton@sina.com>,
        Stefano Garzarella <sgarzare@redhat.com>
Cc:     syzbot <syzbot+3c23789ea938faaef049@syzkaller.appspotmail.com>,
        io-uring@vger.kernel.org, linux-fsdevel@vger.kernel.org,
        linux-kernel@vger.kernel.org,
        Pavel Begunkov <asml.silence@gmail.com>,
        syzkaller-bugs@googlegroups.com, viro@zeniv.linux.org.uk
References: <00000000000030a45905aedd879d@google.com>
 <20200909134317.19732-1-hdanton@sina.com>
From:   Jens Axboe <axboe@kernel.dk>
Message-ID: <4d55d988-d45e-ba36-fed7-342e0a6ab16e@kernel.dk>
Date:   Wed, 9 Sep 2020 08:05:33 -0600
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
 Thunderbird/68.10.0
MIME-Version: 1.0
In-Reply-To: <20200909134317.19732-1-hdanton@sina.com>
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On 9/9/20 7:43 AM, Hillf Danton wrote:
> 
> On Wed, 9 Sep 2020 12:03:55 +0200 Stefano Garzarella wrote:
>> On Wed, Sep 09, 2020 at 01:49:22AM -0700, syzbot wrote:
>>> Hello,
>>>
>>> syzbot found the following issue on:
>>>
>>> HEAD commit:    dff9f829 Add linux-next specific files for 20200908
>>> git tree:       linux-next
>>> console output: https://syzkaller.appspot.com/x/log.txt?x=112f880d900000
>>> kernel config:  https://syzkaller.appspot.com/x/.config?x=37b3426c77bda44c
>>> dashboard link: https://syzkaller.appspot.com/bug?extid=3c23789ea938faaef049
>>> compiler:       gcc (GCC) 10.1.0-syz 20200507
>>> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=17c082a5900000
>>> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1474f5f9900000
>>>
>>> Bisection is inconclusive: the first bad commit could be any of:
>>>
>>> d730b1a2 io_uring: add IOURING_REGISTER_RESTRICTIONS opcode
>>> 7ec3d1dd io_uring: allow disabling rings during the creation
>>
>> I'm not sure it is related, but while rebasing I forgot to update the
>> right label in the error path.
>>
>> Since the check of ring state is after the increase of ctx refcount, we
>> need to decrease it jumping to 'out' label instead of 'out_fput':
> 
> I think we need to fix 6a7bb9ff5744 ("io_uring: remove need for
> sqd->ctx_lock in io_sq_thread()") because the syzbot report
> indicates the io_sq_thread has to wake up the kworker before
> scheduling, and in turn the kworker has the chance to unpark it.
> 
> Below is the minimum walkaround I can have because it can't
> ensure the parker will be waken in every case.
> 
> --- a/fs/io_uring.c
> +++ b/fs/io_uring.c
> @@ -6834,6 +6834,10 @@ static int io_sq_thread(void *data)
>  			io_sq_thread_drop_mm();
>  		}
>  
> +		if (kthread_should_park()) {
> +			/* wake up parker before scheduling */
> +			continue;
> +		}
>  		if (ret & SQT_SPIN) {
>  			io_run_task_work();
>  			cond_resched();
> 

I think this should go in the slow path:


diff --git a/fs/io_uring.c b/fs/io_uring.c
index 652cc53432d4..1c4fa2a0fd82 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -6839,6 +6839,8 @@ static int io_sq_thread(void *data)
 		} else if (ret == SQT_IDLE) {
 			list_for_each_entry(ctx, &sqd->ctx_list, sqd_list)
 				io_ring_set_wakeup_flag(ctx);
+			if (kthread_should_park())
+				continue;
 			schedule();
 			start_jiffies = jiffies;
 		}

-- 
Jens Axboe