Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   luhongfei <luhongfei@vivo.com>
To:     Jens Axboe <axboe@kernel.dk>,
        Pavel Begunkov <asml.silence@gmail.com>,
        io-uring@vger.kernel.org (open list:IO_URING),
        linux-kernel@vger.kernel.org (open list)
Cc:     opensource.kernel@vivo.com, luhongfei <luhongfei@vivo.com>
Subject: [PATCH] Subject: io_uring: Fix bug in io_fallback_req_func that can cause deadlock
Date:   Fri, 12 May 2023 17:56:55 +0800
Message-Id: <20230512095655.8968-1-luhongfei@vivo.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?ai3Nh0EXto8523NGiSs8cqfo/r1cTwH4wfkWqhLZjIKI0NeaHvQoOL57y/rn?=
 =?us-ascii?Q?CqDU3lp5Ve698X43G1bFZmJVNWHgVqXZt0MuHT55YJd7ULVLzqBf7oxxxblz?=
 =?us-ascii?Q?fN63unycYqk7lr+Oqvxxwm7lErQoig31+vuy7diPiPM2QmJYhZpXWlpQ1GQz?=
 =?us-ascii?Q?8tEK3R3fw8ArSfeYKvR9KLyuSx2C2xowHBXp09VQA/UHXAZB4Kari15oL7kQ?=
 =?us-ascii?Q?FD1xzomULS80u0hGFzHWmBECmmOJRfmBJ48sCr+vx/W7rBiqd608DCYFtQAB?=
 =?us-ascii?Q?TmvHuRjIaRgUvIc9kNllcv2uND2UyMjIzuYFwaeZSlCgd++a4g59aPiU69d9?=
 =?us-ascii?Q?q47eqJdUmNRznq7RWb5R9ztnrNcJZZIo13pZ39p60qek5/LchSzbaxlqPYCJ?=
 =?us-ascii?Q?4PfbC3w/Vzn5/BNgqlfyIRi48cPOnqgCv8EmSJP/IpHBa4N4ZtjhTeGEQxro?=
 =?us-ascii?Q?pvmuVZQ+qtR5XpGCO4aJfio7qMl42VVaidCLEa7XfVWn+cFsC58oZ0cypY4H?=
 =?us-ascii?Q?3IU+1wXgm46mytfbkc55OMVUuATZDtahBlJHmRx1lVuyDgOgWkNHd+FLLs7Y?=
 =?us-ascii?Q?Wdtqlaxs8bpRPbJN5EuvmKRRgbLvnNyKgSzaTS3vQ+NZFyI4Rr563z6KvGjp?=
 =?us-ascii?Q?M/lPyyDEKYYEWsU1+BBXANQB0jHWQTyIVuGR3b0dJB9GKXm/gtzNMx0pJBIg?=
 =?us-ascii?Q?IMnjU+/9c9rbjZtxGPk/O+udZpeUyGrRnnaIouLR16pzE9FrEKjALNh0wrxo?=
 =?us-ascii?Q?mtNEmVmtZF0oye9AONuqOhyrQs82PTKB+CIL+IeCNQo69WPO2+VdwGUGsUEh?=
 =?us-ascii?Q?EtoAuOBttBPq1DWwMbtKirzCTkzlrzRvKGcLVmd1Ole6771dKKHSj2L10o4T?=
 =?us-ascii?Q?iNVKj4sewGSGgRvlwj3O8/1xksvVs1FIAkq2Vzkkc6g/TW8gReJumX2MSQIY?=
 =?us-ascii?Q?aUaHLWPTdgXuCsZsHaw4F/7QMd9d8BRCcKY/uff29GhsC56D2gYq77YDerMy?=
 =?us-ascii?Q?SS+3hj3BHOSihztSJfnx5jDniRj6cV8BEx46Kz4h8vZGAMQWJh0hmgts2H3U?=
 =?us-ascii?Q?NNNY5KZaGt9+BEIM94W8WIgAKIR1OMr0Djnabir4BnHarTT+vnHF22JY3qN6?=
 =?us-ascii?Q?YgliKi/IWVcJ0blhRokoTHqHilYaaIz/0/215Fi7dLkiBvuMsQyRwCo7VZLc?=
 =?us-ascii?Q?r7fz0+MECB8VHhV/lPS5midcxN/HVoSlBvFqN8kW5OzO63DUHIHsiJnKS7Rm?=
 =?us-ascii?Q?jzrWHlRcjy1Me4QUeqPxLX6Ih/jPqxp9JvFbcc5suJFaaU8YnmSK/TPCPPyg?=
 =?us-ascii?Q?Lxixzf+5oh1pOytB1FVPyjKKAsGv9Im5+ne6lwsw0LVJNfukVvIUDcYOCMAp?=
 =?us-ascii?Q?tQXp6n9UWHGpNGfdX4yY1DnPYfGFZuNdUFYcjKGMvRl78mXl+LB+3+mUHyAh?=
 =?us-ascii?Q?plSfyhfwvLadFsUeAvxpLinubBODZvTdu76Tuz9hb4UgdlvH0VveXqU6q7BX?=
 =?us-ascii?Q?r0x9TPE+Cl2GjP4FcQqZyw6iatwtpEZ7Eq5chOVzewhvBxjbxn3bJ/e0A8EY?=
 =?us-ascii?Q?nTNSK9idDmaWVWr4E1GA8I4//sqAJ3hN8YVDOmAg?=
X-OriginatorOrg: vivo.com
X-MS-Exchange-CrossTenant-Network-Message-Id: b135958a-020b-46f0-411f-08db52cf3e55
X-MS-Exchange-CrossTenant-AuthSource: SG2PR06MB2169.apcprd06.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 12 May 2023 09:57:06.3108
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 923e42dc-48d5-4cbe-b582-1a797a6412ed
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 2yFhpaDRpNE9ANuk+r7LJAsj+d9sweWsUhtrADbxI8yJV2NpyolobHV45aeBRCFrI67fQt5y46D8mimnIq0Rmw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: TY0PR06MB5401
X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE,
        RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_PASS,T_SCC_BODY_TEXT_LINE,
        URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

There was a bug in io_fallback_req_func that can cause deadlocks
because uring_lock was not released when return.
This patch releases the uring_lock before return.

Signed-off-by: luhongfei <luhongfei@vivo.com>
---
 io_uring/io_uring.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)
 mode change 100644 => 100755 io_uring/io_uring.c

diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index 3bca7a79efda..1af793c7b3da
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -252,8 +252,10 @@ static __cold void io_fallback_req_func(struct work_struct *work)
 	mutex_lock(&ctx->uring_lock);
 	llist_for_each_entry_safe(req, tmp, node, io_task_work.node)
 		req->io_task_work.func(req, &ts);
-	if (WARN_ON_ONCE(!ts.locked))
+	if (WARN_ON_ONCE(!ts.locked)) {
+		mutex_unlock(&ctx->uring_lock);
 		return;
+	}
 	io_submit_flush_completions(ctx);
 	mutex_unlock(&ctx->uring_lock);
 }
-- 
2.39.0