887ba598d9
commit 8f7033aa4089fbaf7a33995f0f2ee6c9d7b9ca1b upstream.
When the sqpoll is exiting and cancels pending work items, it may need
to run task_work. If this happens from within io_uring_cancel_generic(),
then it may be under waiting for the io_uring_task waitqueue. This
results in the below splat from the scheduler, as the ring mutex may be
attempted grabbed while in a TASK_INTERRUPTIBLE state.
Ensure that the task state is set appropriately for that, just like what
is done for the other cases in io_run_task_work().
do not call blocking ops when !TASK_RUNNING; state=1 set at [<0000000029387fd2>] prepare_to_wait+0x88/0x2fc
WARNING: CPU: 6 PID: 59939 at kernel/sched/core.c:8561 __might_sleep+0xf4/0x140
Modules linked in:
CPU: 6 UID: 0 PID: 59939 Comm: iou-sqp-59938 Not tainted 6.12.0-rc3-00113-g8d020023b155 #7456
Hardware name: linux,dummy-virt (DT)
pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
pc : __might_sleep+0xf4/0x140
lr : __might_sleep+0xf4/0x140
sp : ffff80008c5e7830
x29: ffff80008c5e7830 x28: ffff0000d93088c0 x27: ffff60001c2d7230
x26: dfff800000000000 x25: ffff0000e16b9180 x24: ffff80008c5e7a50
x23: 1ffff000118bcf4a x22: ffff0000e16b9180 x21: ffff0000e16b9180
x20: 000000000000011b x19: ffff80008310fac0 x18: 1ffff000118bcd90
x17: 30303c5b20746120 x16: 74657320313d6574 x15: 0720072007200720
x14: 0720072007200720 x13: 0720072007200720 x12: ffff600036c64f0b
x11: 1fffe00036c64f0a x10: ffff600036c64f0a x9 : dfff800000000000
x8 : 00009fffc939b0f6 x7 : ffff0001b6327853 x6 : 0000000000000001
x5 : ffff0001b6327850 x4 : ffff600036c64f0b x3 : ffff8000803c35bc
x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000e16b9180
Call trace:
__might_sleep+0xf4/0x140
mutex_lock+0x84/0x124
io_handle_tw_list+0xf4/0x260
tctx_task_work_run+0x94/0x340
io_run_task_work+0x1ec/0x3c0
io_uring_cancel_generic+0x364/0x524
io_sq_thread+0x820/0x124c
ret_from_fork+0x10/0x20
Cc: stable@vger.kernel.org
Fixes:
|
||
---|---|---|
.. | ||
advise.c | ||
advise.h | ||
alloc_cache.h | ||
cancel.c | ||
cancel.h | ||
epoll.c | ||
epoll.h | ||
eventfd.c | ||
eventfd.h | ||
fdinfo.c | ||
fdinfo.h | ||
filetable.c | ||
filetable.h | ||
fs.c | ||
fs.h | ||
futex.c | ||
futex.h | ||
io-wq.c | ||
io-wq.h | ||
io_uring.c | ||
io_uring.h | ||
kbuf.c | ||
kbuf.h | ||
Makefile | ||
memmap.c | ||
memmap.h | ||
msg_ring.c | ||
msg_ring.h | ||
napi.c | ||
napi.h | ||
net.c | ||
net.h | ||
nop.c | ||
nop.h | ||
notif.c | ||
notif.h | ||
opdef.c | ||
opdef.h | ||
openclose.c | ||
openclose.h | ||
poll.c | ||
poll.h | ||
refs.h | ||
register.c | ||
register.h | ||
rsrc.c | ||
rsrc.h | ||
rw.c | ||
rw.h | ||
slist.h | ||
splice.c | ||
splice.h | ||
sqpoll.c | ||
sqpoll.h | ||
statx.c | ||
statx.h | ||
sync.c | ||
sync.h | ||
tctx.c | ||
tctx.h | ||
timeout.c | ||
timeout.h | ||
truncate.c | ||
truncate.h | ||
uring_cmd.c | ||
uring_cmd.h | ||
waitid.c | ||
waitid.h | ||
xattr.c | ||
xattr.h |