This is a note to let you know that I've just added the patch titled io_uring: unconditionally grab req->task to the 5.8-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: io_uring-unconditionally-grab-req-task.patch and it can be found in the queue-5.8 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From foo@baz Thu Oct 29 01:16:54 PM CET 2020 From: Jens Axboe <axboe@xxxxxxxxx> Date: Mon, 12 Oct 2020 11:25:39 -0600 Subject: io_uring: unconditionally grab req->task From: Jens Axboe <axboe@xxxxxxxxx> commit e3bc8e9dad7f2f83cc807111d4472164c9210153 upstream. Sometimes we assign a weak reference to it, sometimes we grab a reference to it. Clean this up and make it unconditional, and drop the flag related to tracking this state. Reviewed-by: Pavel Begunkov <asml.silence@xxxxxxxxx> Signed-off-by: Jens Axboe <axboe@xxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- fs/io_uring.c | 26 +++----------------------- 1 file changed, 3 insertions(+), 23 deletions(-) --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -550,7 +550,6 @@ enum { REQ_F_NO_FILE_TABLE_BIT, REQ_F_QUEUE_TIMEOUT_BIT, REQ_F_WORK_INITIALIZED_BIT, - REQ_F_TASK_PINNED_BIT, /* not a real bit, just to check we're not overflowing the space */ __REQ_F_LAST_BIT, @@ -608,8 +607,6 @@ enum { REQ_F_QUEUE_TIMEOUT = BIT(REQ_F_QUEUE_TIMEOUT_BIT), /* io_wq_work is initialized */ REQ_F_WORK_INITIALIZED = BIT(REQ_F_WORK_INITIALIZED_BIT), - /* req->task is refcounted */ - REQ_F_TASK_PINNED = BIT(REQ_F_TASK_PINNED_BIT), }; struct async_poll { @@ -924,21 +921,6 @@ struct sock *io_uring_get_socket(struct } EXPORT_SYMBOL(io_uring_get_socket); -static void io_get_req_task(struct io_kiocb *req) -{ - if (req->flags & REQ_F_TASK_PINNED) - return; - get_task_struct(req->task); - req->flags |= REQ_F_TASK_PINNED; -} - -/* not idempotent -- it doesn't clear REQ_F_TASK_PINNED */ -static void __io_put_req_task(struct io_kiocb *req) -{ - if (req->flags & REQ_F_TASK_PINNED) - put_task_struct(req->task); -} - static void io_file_put_work(struct work_struct *work); /* @@ -1455,7 +1437,7 @@ static void __io_req_aux_free(struct io_ kfree(req->io); if (req->file) io_put_file(req, req->file, (req->flags & REQ_F_FIXED_FILE)); - __io_put_req_task(req); + put_task_struct(req->task); io_req_work_drop_env(req); } @@ -1765,7 +1747,7 @@ static inline bool io_req_multi_free(str if ((req->flags & REQ_F_LINK_HEAD) || io_is_fallback_req(req)) return false; - if (req->file || req->io) + if (req->file || req->io || req->task) rb->need_iter++; rb->reqs[rb->to_free++] = req; @@ -4584,7 +4566,6 @@ static bool io_arm_poll_handler(struct i if (req->flags & REQ_F_WORK_INITIALIZED) memcpy(&apoll->work, &req->work, sizeof(req->work)); - io_get_req_task(req); req->apoll = apoll; INIT_HLIST_NODE(&req->hash_node); @@ -4774,8 +4755,6 @@ static int io_poll_add_prep(struct io_ki events = READ_ONCE(sqe->poll_events); poll->events = demangle_poll(events) | EPOLLERR | EPOLLHUP; - - io_get_req_task(req); return 0; } @@ -6057,6 +6036,7 @@ static int io_init_req(struct io_ring_ct /* one is dropped after submission, the other at completion */ refcount_set(&req->refs, 2); req->task = current; + get_task_struct(req->task); req->result = 0; if (unlikely(req->opcode >= IORING_OP_LAST)) Patches currently in stable-queue which might be from axboe@xxxxxxxxx are queue-5.8/io_uring-convert-advanced-xarray-uses-to-the-normal-api.patch queue-5.8/io_uring-don-t-run-task-work-on-an-exiting-task.patch queue-5.8/io_uring-reference-nsproxy-for-file-table-commands.patch queue-5.8/io_uring-stash-ctx-task-reference-for-sqpoll.patch queue-5.8/io_uring-return-cancelation-status-from-poll-timeout-files-handlers.patch queue-5.8/io_uring-fix-xarray-usage-in-io_uring_add_task_file.patch queue-5.8/io_uring-fix-use-of-xarray-in-__io_uring_files_cancel.patch queue-5.8/io-wq-fix-use-after-free-in-io_wq_worker_running.patch queue-5.8/io_uring-don-t-rely-on-weak-files-references.patch queue-5.8/io_uring-allow-timeout-poll-files-killing-to-take-task-into-account.patch queue-5.8/io_uring-move-dropping-of-files-into-separate-helper.patch queue-5.8/io_uring-unconditionally-grab-req-task.patch queue-5.8/io_uring-enable-task-files-specific-overflow-flushing.patch queue-5.8/io_wq-make-io_wqe-lock-a-raw_spinlock_t.patch queue-5.8/io_uring-no-need-to-call-xa_destroy-on-empty-xarray.patch