This is a note to let you know that I've just added the patch titled io_uring/rw: ensure kiocb_end_write() is always called to the 5.15-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: io_uring-rw-ensure-kiocb_end_write-is-always-called.patch and it can be found in the queue-5.15 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 847059841bf49921adc58c31b910b52e46568e3e Mon Sep 17 00:00:00 2001 From: Jens Axboe <axboe@xxxxxxxxx> Date: Sun, 22 Jan 2023 10:36:37 -0700 Subject: io_uring/rw: ensure kiocb_end_write() is always called From: Jens Axboe <axboe@xxxxxxxxx> commit 2ec33a6c3cca9fe2465e82050c81f5ffdc508b36 upstream. A previous commit moved the notifications and end-write handling, but it is now missing a few spots where we also want to call both of those. Without that, we can potentially be missing file notifications, and more importantly, have an imbalance in the super_block writers sem accounting. Fixes: b000145e9907 ("io_uring/rw: defer fsnotify calls to task context") Reported-by: Dave Chinner <david@xxxxxxxxxxxxx> Link: https://lore.kernel.org/all/20221010050319.GC2703033@xxxxxxxxxxxxxxxxxxx/ Signed-off-by: Jens Axboe <axboe@xxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- io_uring/io_uring.c | 57 +++++++++++++++++++++++++++++++++------------------- 1 file changed, 37 insertions(+), 20 deletions(-) --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -2703,11 +2703,34 @@ static bool io_rw_should_reissue(struct } #endif +/* + * Trigger the notifications after having done some IO, and finish the write + * accounting, if any. + */ +static void io_req_io_end(struct io_kiocb *req) +{ + struct io_rw *rw = &req->rw; + + WARN_ON(!in_task()); + + if (rw->kiocb.ki_flags & IOCB_WRITE) { + kiocb_end_write(req); + fsnotify_modify(req->file); + } else { + fsnotify_access(req->file); + } +} + static bool __io_complete_rw_common(struct io_kiocb *req, long res) { if (res != req->result) { if ((res == -EAGAIN || res == -EOPNOTSUPP) && io_rw_should_reissue(req)) { + /* + * Reissue will start accounting again, finish the + * current cycle. + */ + io_req_io_end(req); req->flags |= REQ_F_REISSUE; return true; } @@ -2749,25 +2772,9 @@ static void io_req_task_complete(struct } } -static void __io_complete_rw(struct io_kiocb *req, long res, long res2, - unsigned int issue_flags) -{ - if (__io_complete_rw_common(req, res)) - return; - __io_req_complete(req, issue_flags, io_fixup_rw_res(req, res), io_put_rw_kbuf(req)); -} - static void io_req_rw_complete(struct io_kiocb *req, bool *locked) { - struct io_rw *rw = &req->rw; - - if (rw->kiocb.ki_flags & IOCB_WRITE) { - kiocb_end_write(req); - fsnotify_modify(req->file); - } else { - fsnotify_access(req->file); - } - + io_req_io_end(req); io_req_task_complete(req, locked); } @@ -3035,10 +3042,20 @@ static void kiocb_done(struct kiocb *kio if (req->flags & REQ_F_CUR_POS) req->file->f_pos = kiocb->ki_pos; - if (ret >= 0 && (kiocb->ki_complete == io_complete_rw)) - __io_complete_rw(req, ret, 0, issue_flags); - else + if (ret >= 0 && (kiocb->ki_complete == io_complete_rw)) { + if (!__io_complete_rw_common(req, ret)) { + /* + * Safe to call io_end from here as we're inline + * from the submission path. + */ + io_req_io_end(req); + __io_req_complete(req, issue_flags, + io_fixup_rw_res(req, ret), + io_put_rw_kbuf(req)); + } + } else { io_rw_done(kiocb, ret); + } if (req->flags & REQ_F_REISSUE) { req->flags &= ~REQ_F_REISSUE; Patches currently in stable-queue which might be from axboe@xxxxxxxxx are queue-5.15/io_uring-improve-send-recv-error-handling.patch queue-5.15/eventfd-provide-a-eventfd_signal_mask-helper.patch queue-5.15/io_uring-rw-ensure-kiocb_end_write-is-always-called.patch queue-5.15/eventpoll-add-epoll_uring_wake-poll-wakeup-flag.patch queue-5.15/io_uring-remove-duplicated-calls-to-io_kiocb_ppos.patch queue-5.15/io_uring-add-flag-for-disabling-provided-buffer-recy.patch queue-5.15/io_uring-fix-async-accept-on-o_nonblock-sockets.patch queue-5.15/io_uring-ensure-recv-and-recvmsg-handle-msg_waitall-.patch queue-5.15/io_uring-don-t-gate-task_work-run-on-tif_notify_sign.patch queue-5.15/block-mq-deadline-rename-deadline_is_seq_writes.patch queue-5.15/io_uring-update-kiocb-ki_pos-at-execution-time.patch queue-5.15/io_uring-do-not-recalculate-ppos-unnecessarily.patch queue-5.15/io_uring-support-msg_waitall-for-ioring_op_send-msg.patch queue-5.15/io_uring-rw-remove-leftover-debug-statement.patch queue-5.15/io_uring-pass-in-epoll_uring_wake-for-eventfd-signal.patch queue-5.15/io_uring-allow-re-poll-if-we-made-progress.patch queue-5.15/io_uring-net-fix-fast_iov-assignment-in-io_setup_async_msg.patch queue-5.15/io_uring-clean-up-a-false-positive-warning-from-gcc-9.3.0.patch queue-5.15/io_uring-fix-double-poll-leak-on-repolling.patch queue-5.15/io_uring-ensure-that-cached-task-references-are-alwa.patch queue-5.15/io_uring-rw-defer-fsnotify-calls-to-task-context.patch queue-5.15/io_uring-io_kiocb_update_pos-should-not-touch-file-for-non-1-offset.patch