mirror of
git://git.yoctoproject.org/linux-yocto.git
synced 2026-01-27 12:47:24 +01:00
704cced8ed
commit da579f05ef0faada3559e7faddf761c75cdf85e1 upstream.
With IORING_SETUP_DEFER_TASKRUN, task work is queued to ctx->work_llist
(local work) rather than the fallback list. During io_ring_exit_work(),
io_move_task_work_from_local() was called once before the cancel loop,
moving work from work_llist to fallback_llist.
However, task work can be added to work_llist during the cancel loop
itself. There are two cases:
1) io_kill_timeouts() is called from io_uring_try_cancel_requests() to
cancel pending timeouts, and it adds task work via io_req_queue_tw_complete()
for each cancelled timeout:
2) URING_CMD requests like ublk can be completed via
io_uring_cmd_complete_in_task() from ublk_queue_rq() during canceling,
given ublk request queue is only quiesced when canceling the 1st uring_cmd.
Since io_allowed_defer_tw_run() returns false in io_ring_exit_work()
(kworker != submitter_task), io_run_local_work() is never invoked,
and the work_llist entries are never processed. This causes
io_uring_try_cancel_requests() to loop indefinitely, resulting in
100% CPU usage in kworker threads.
Fix this by moving io_move_task_work_from_local() inside the cancel
loop, ensuring any work on work_llist is moved to fallback before
each cancel attempt.
Cc: stable@vger.kernel.org
Fixes:
|
||
|---|---|---|
| .. | ||
| advise.c | ||
| advise.h | ||
| alloc_cache.c | ||
| alloc_cache.h | ||
| cancel.c | ||
| cancel.h | ||
| cmd_net.c | ||
| epoll.c | ||
| epoll.h | ||
| eventfd.c | ||
| eventfd.h | ||
| fdinfo.c | ||
| fdinfo.h | ||
| filetable.c | ||
| filetable.h | ||
| fs.c | ||
| fs.h | ||
| futex.c | ||
| futex.h | ||
| io_uring.c | ||
| io_uring.h | ||
| io-wq.c | ||
| io-wq.h | ||
| kbuf.c | ||
| kbuf.h | ||
| Kconfig | ||
| Makefile | ||
| memmap.c | ||
| memmap.h | ||
| mock_file.c | ||
| msg_ring.c | ||
| msg_ring.h | ||
| napi.c | ||
| napi.h | ||
| net.c | ||
| net.h | ||
| nop.c | ||
| nop.h | ||
| notif.c | ||
| notif.h | ||
| opdef.c | ||
| opdef.h | ||
| openclose.c | ||
| openclose.h | ||
| poll.c | ||
| poll.h | ||
| query.c | ||
| query.h | ||
| refs.h | ||
| register.c | ||
| register.h | ||
| rsrc.c | ||
| rsrc.h | ||
| rw.c | ||
| rw.h | ||
| slist.h | ||
| splice.c | ||
| splice.h | ||
| sqpoll.c | ||
| sqpoll.h | ||
| statx.c | ||
| statx.h | ||
| sync.c | ||
| sync.h | ||
| tctx.c | ||
| tctx.h | ||
| timeout.c | ||
| timeout.h | ||
| truncate.c | ||
| truncate.h | ||
| uring_cmd.c | ||
| uring_cmd.h | ||
| waitid.c | ||
| waitid.h | ||
| xattr.c | ||
| xattr.h | ||
| zcrx.c | ||
| zcrx.h | ||