On 2/20/20 3:58 PM, Jann Horn wrote: > On Thu, Feb 20, 2020 at 11:56 PM Jens Axboe <axboe@xxxxxxxxx> wrote: >> On 2/20/20 3:38 PM, Jann Horn wrote: >>> On Thu, Feb 20, 2020 at 11:23 PM Jens Axboe <axboe@xxxxxxxxx> wrote: >>>> On 2/20/20 3:14 PM, Jens Axboe wrote: >>>>>>> @@ -3646,46 +3596,11 @@ static int io_poll_wake(struct wait_queue_entry *wait, unsigned mode, int sync, >>>>>>> >>>>>>> list_del_init(&poll->wait.entry); >>>>>>> >>>>>> [...] >>>>>>> + tsk = req->task; >>>>>>> + req->result = mask; >>>>>>> + init_task_work(&req->sched_work, io_poll_task_func); >>>>>>> + sched_work_add(tsk, &req->sched_work); >>>>>> >>>>>> Doesn't this have to check the return value? >>>>> >>>>> Trying to think if we can get here with TASK_EXITING, but probably safer >>>>> to just handle it in any case. I'll add that. >>>> >>>> Double checked this one, and I think it's good as-is, but needs a >>>> comment. If the sched_work_add() fails, then the work item is still in >>>> the poll hash on the ctx. That work is canceled on exit. >>> >>> You mean via io_poll_remove_all()? That doesn't happen when a thread >>> dies, right? >> >> Off of io_uring_flush, we do: >> >> if (fatal_signal_pending(current) || (current->flags & PF_EXITING)) { >> io_uring_cancel_task_poll(current); >> io_uring_cancel_task_async(current); >> io_wq_cancel_pid(ctx->io_wq, task_pid_vnr(current)); >> } >> >> to cancel _anything_ that the task has pending. > > ->flush() is only for when the uring instance is dropped from a file > descriptor table; threads typically share their file descriptor > tables, and therefore won't ->flush() until the last one dies. True, then I guess I'll need some other notifier for that particular case. Might be able to use sched_work_run() for that, since we know that'll definitely get called when the task exits. -- Jens Axboe