io_uring: enable lookup of links holding inflight files

When a process exits, we cancel whatever requests it has pending that
are referencing the file table. However, if a link is holding a
reference, then we cannot find it by simply looking at the inflight
list.

Enable checking of the poll and timeout list to find the link, and
cancel it appropriately.

Cc: stable@vger.kernel.org
Reported-by: Josef <josef.grieb@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 8a2afd8..1ec25ee 100644 (file)
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -4937,6 +4937,7 @@ static bool io_poll_remove_one(struct io_kiocb *req)
                io_cqring_fill_event(req, -ECANCELED);
                io_commit_cqring(req->ctx);
                req->flags |= REQ_F_COMP_LOCKED;
+               req_set_fail_links(req);
                io_put_req(req);
        }
 
@@ -5109,6 +5110,23 @@ static enum hrtimer_restart io_timeout_fn(struct hrtimer *timer)
        return HRTIMER_NORESTART;
 }
 
+static int __io_timeout_cancel(struct io_kiocb *req)
+{
+       int ret;
+
+       list_del_init(&req->timeout.list);
+
+       ret = hrtimer_try_to_cancel(&req->io->timeout.timer);
+       if (ret == -1)
+               return -EALREADY;
+
+       req_set_fail_links(req);
+       req->flags |= REQ_F_COMP_LOCKED;
+       io_cqring_fill_event(req, -ECANCELED);
+       io_put_req(req);
+       return 0;
+}
+
 static int io_timeout_cancel(struct io_ring_ctx *ctx, __u64 user_data)
 {
        struct io_kiocb *req;
@@ -5116,7 +5134,6 @@ static int io_timeout_cancel(struct io_ring_ctx *ctx, __u64 user_data)
 
        list_for_each_entry(req, &ctx->timeout_list, timeout.list) {
                if (user_data == req->user_data) {
-                       list_del_init(&req->timeout.list);
                        ret = 0;
                        break;
                }
@@ -5125,15 +5142,7 @@ static int io_timeout_cancel(struct io_ring_ctx *ctx, __u64 user_data)
        if (ret == -ENOENT)
                return ret;
 
-       ret = hrtimer_try_to_cancel(&req->io->timeout.timer);
-       if (ret == -1)
-               return -EALREADY;
-
-       req_set_fail_links(req);
-       req->flags |= REQ_F_COMP_LOCKED;
-       io_cqring_fill_event(req, -ECANCELED);
-       io_put_req(req);
-       return 0;
+       return __io_timeout_cancel(req);
 }
 
 static int io_timeout_remove_prep(struct io_kiocb *req,
@@ -7935,6 +7944,71 @@ static bool io_wq_files_match(struct io_wq_work *work, void *data)
        return work->files == files;
 }
 
+/*
+ * Returns true if 'preq' is the link parent of 'req'
+ */
+static bool io_match_link(struct io_kiocb *preq, struct io_kiocb *req)
+{
+       struct io_kiocb *link;
+
+       if (!(preq->flags & REQ_F_LINK_HEAD))
+               return false;
+
+       list_for_each_entry(link, &preq->link_list, link_list) {
+               if (link == req)
+                       return true;
+       }
+
+       return false;
+}
+
+/*
+ * We're looking to cancel 'req' because it's holding on to our files, but
+ * 'req' could be a link to another request. See if it is, and cancel that
+ * parent request if so.
+ */
+static bool io_poll_remove_link(struct io_ring_ctx *ctx, struct io_kiocb *req)
+{
+       struct hlist_node *tmp;
+       struct io_kiocb *preq;
+       bool found = false;
+       int i;
+
+       spin_lock_irq(&ctx->completion_lock);
+       for (i = 0; i < (1U << ctx->cancel_hash_bits); i++) {
+               struct hlist_head *list;
+
+               list = &ctx->cancel_hash[i];
+               hlist_for_each_entry_safe(preq, tmp, list, hash_node) {
+                       found = io_match_link(preq, req);
+                       if (found) {
+                               io_poll_remove_one(preq);
+                               break;
+                       }
+               }
+       }
+       spin_unlock_irq(&ctx->completion_lock);
+       return found;
+}
+
+static bool io_timeout_remove_link(struct io_ring_ctx *ctx,
+                                  struct io_kiocb *req)
+{
+       struct io_kiocb *preq;
+       bool found = false;
+
+       spin_lock_irq(&ctx->completion_lock);
+       list_for_each_entry(preq, &ctx->timeout_list, timeout.list) {
+               found = io_match_link(preq, req);
+               if (found) {
+                       __io_timeout_cancel(preq);
+                       break;
+               }
+       }
+       spin_unlock_irq(&ctx->completion_lock);
+       return found;
+}
+
 static void io_uring_cancel_files(struct io_ring_ctx *ctx,
                                  struct files_struct *files)
 {
@@ -7989,6 +8063,9 @@ static void io_uring_cancel_files(struct io_ring_ctx *ctx,
                        }
                } else {
                        io_wq_cancel_work(ctx->io_wq, &cancel_req->work);
+                       /* could be a link, check and remove if it is */
+                       if (!io_poll_remove_link(ctx, cancel_req))
+                               io_timeout_remove_link(ctx, cancel_req);
                        io_put_req(cancel_req);
                }