On 9/26/20 7:26 AM, Hillf Danton wrote:
> --- a/fs/io-wq.c
> +++ b/fs/io-wq.c
> @@ -200,7 +200,6 @@ static void io_worker_exit(struct io_wor
> {
> struct io_wqe *wqe = worker->wqe;
> struct io_wqe_acct *acct = io_wqe_get_acct(wqe, worker);
> - unsigned nr_workers;
>
> /*
> * If we're not at zero, someone else is holding a brief reference
> @@ -228,15 +227,11 @@ static void io_worker_exit(struct io_wor
> raw_spin_lock_irq(&wqe->lock);
> }
> acct->nr_workers--;
> - nr_workers = wqe->acct[IO_WQ_ACCT_BOUND].nr_workers +
> - wqe->acct[IO_WQ_ACCT_UNBOUND].nr_workers;
> raw_spin_unlock_irq(&wqe->lock);
>
> - /* all workers gone, wq exit can proceed */
> - if (!nr_workers && refcount_dec_and_test(&wqe->wq->refs))
> - complete(&wqe->wq->done);
> -
> kfree_rcu(worker, rcu);
> + if (refcount_dec_and_test(&wqe->wq->refs))
> + complete(&wqe->wq->done);
> }
Nice, we came up with the same fix, thanks a lot for looking into this.
I pushed this one out for syzbot to test:
https://git.kernel.dk/cgit/linux-block/commit/?h=io_uring-5.9&id=41d5f92f60a61e264dafbada79175dad0bc60c5b
which is basically identical. I did consider the EXIT check as well, but
we don't really need it, so I'd prefer to leave that out of it.
I'll queue yours up.
--
Jens Axboe
