commit 0f8da75b51ac863b9435368bd50691718cc454b0
author Pavel Begunkov <asml.silence@gmail.com> Tue Apr 12 15:24:43 2022 +0100
committer Jens Axboe <axboe@kernel.dk> Tue Apr 12 08:39:49 2022 -0600
tree b0cc3c6152d2f58e796432075eabffe0956a6a7c
parent 82733d168cbd3fe9dab603f05894316b99008924

io_uring: fix assign file locking issue

io-wq work cancellation path can't take uring_lock as how it's done on
file assignment, we have to handle IO_WQ_WORK_CANCEL first, this fixes
encountered hangs.

Fixes: 6bf9c47a3989 ("io_uring: defer file assignment")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/0d9b9f37841645518503f6a207e509d14a286aba.1649773463.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>

fs/io_uring.c

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 38e62b1..8a931eb 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -7277,16 +7277,18 @@ static void io_wq_submit_work(struct io_wq_work *work)
 	if (timeout)
 		io_queue_linked_timeout(timeout);
 
-	if (!io_assign_file(req, issue_flags)) {
-		err = -EBADF;
-		work->flags |= IO_WQ_WORK_CANCEL;
-	}
 
 	/* either cancelled or io-wq is dying, so don't touch tctx->iowq */
 	if (work->flags & IO_WQ_WORK_CANCEL) {
+fail:
 		io_req_task_queue_fail(req, err);
 		return;
 	}
+	if (!io_assign_file(req, issue_flags)) {
+		err = -EBADF;
+		work->flags |= IO_WQ_WORK_CANCEL;
+		goto fail;
+	}
 
 	if (req->flags & REQ_F_FORCE_ASYNC) {
 		bool opcode_poll = def->pollin || def->pollout;