This is a note to let you know that I've just added the patch titled io_uring: ensure local task_work is run on wait timeout to the 6.7-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: io_uring-ensure-local-task_work-is-run-on-wait-timeout.patch and it can be found in the queue-6.7 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 6ff1407e24e6fdfa4a16ba9ba551e3d253a26391 Mon Sep 17 00:00:00 2001 From: Jens Axboe <axboe@xxxxxxxxx> Date: Thu, 4 Jan 2024 12:21:08 -0700 Subject: io_uring: ensure local task_work is run on wait timeout From: Jens Axboe <axboe@xxxxxxxxx> commit 6ff1407e24e6fdfa4a16ba9ba551e3d253a26391 upstream. A previous commit added an earlier break condition here, which is fine if we're using non-local task_work as it'll be run on return to userspace. However, if DEFER_TASKRUN is used, then we could be leaving local task_work that is ready to process in the ctx list until next time that we enter the kernel to wait for events. Move the break condition to _after_ we have run task_work. Cc: stable@xxxxxxxxxxxxxxx Fixes: 846072f16eed ("io_uring: mimimise io_cqring_wait_schedule") Signed-off-by: Jens Axboe <axboe@xxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- io_uring/io_uring.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -2637,8 +2637,6 @@ static int io_cqring_wait(struct io_ring __set_current_state(TASK_RUNNING); atomic_set(&ctx->cq_wait_nr, 0); - if (ret < 0) - break; /* * Run task_work after scheduling and before io_should_wake(). * If we got woken because of task_work being processed, run it @@ -2648,6 +2646,18 @@ static int io_cqring_wait(struct io_ring if (!llist_empty(&ctx->work_llist)) io_run_local_work(ctx); + /* + * Non-local task_work will be run on exit to userspace, but + * if we're using DEFER_TASKRUN, then we could have waited + * with a timeout for a number of requests. If the timeout + * hits, we could have some requests ready to process. Ensure + * this break is _after_ we have run task_work, to avoid + * deferring running potentially pending requests until the + * next time we wait for events. + */ + if (ret < 0) + break; + check_cq = READ_ONCE(ctx->check_cq); if (unlikely(check_cq)) { /* let the caller flush overflows, retry */ Patches currently in stable-queue which might be from axboe@xxxxxxxxx are queue-6.7/blk-cgroup-fix-rcu-lockdep-warning-in-blkg_lookup.patch queue-6.7/block-fix-iterating-over-an-empty-bio-with-bio_for_each_folio_all.patch queue-6.7/io_uring-don-t-check-iopoll-if-request-completes.patch queue-6.7/null_blk-don-t-cap-max_hw_sectors-to-blk_def_max_sec.patch queue-6.7/block-add-check-of-minors-and-first_minor-in-device_.patch queue-6.7/io_uring-rw-ensure-io-bytes_done-is-always-initialized.patch queue-6.7/md-raid1-use-blk_opf_t-for-read-and-write-operations.patch queue-6.7/block-remove-special-casing-of-compound-pages.patch queue-6.7/block-set-memalloc_noio-to-false-on-device_add_disk-.patch queue-6.7/io_uring-ensure-local-task_work-is-run-on-wait-timeout.patch queue-6.7/scsi-target-core-add-missing-file_-start-end-_write.patch queue-6.7/block-add-check-that-partition-length-needs-to-be-aligned-with-block-size.patch