Re: [PATCH v3 0/4] forbid fix {SQ,IO}POLL

[Pavel Begunkov]

On 04/06/2020 22:52, Jens Axboe wrote:
> On 6/4/20 1:22 PM, Pavel Begunkov wrote:
>> On 04/06/2020 20:06, Jens Axboe wrote:
>>> On 6/3/20 12:51 PM, Jens Axboe wrote:
>>>> On 6/3/20 9:03 AM, Pavel Begunkov wrote:
>>>>> The first one adds checks {SQPOLL,IOPOLL}. IOPOLL check can be
>>>>> moved in the common path later, or rethinked entirely, e.g.
>>>>> not io_iopoll_req_issued()'ed for unsupported opcodes.
>>>>>
>>>>> 3 others are just cleanups on top.
>>>>>
>>>>>
>>>>> v2: add IOPOLL to the whole bunch of opcodes in [1/4].
>>>>>     dirty and effective.
>>>>> v3: sent wrong set in v2, re-sending right one 
>>>>>
>>>>> Pavel Begunkov (4):
>>>>>   io_uring: fix {SQ,IO}POLL with unsupported opcodes
>>>>>   io_uring: do build_open_how() only once
>>>>>   io_uring: deduplicate io_openat{,2}_prep()
>>>>>   io_uring: move send/recv IOPOLL check into prep
>>>>>
>>>>>  fs/io_uring.c | 94 ++++++++++++++++++++++++++-------------------------
>>>>>  1 file changed, 48 insertions(+), 46 deletions(-)
>>>>
>>>> Thanks, applied.
>>>
>>> #1 goes too far, provide/remove buffers is fine with iopoll. I'll
>>> going to edit the patch.
>>
>> Conceptually it should work, but from a quick look:
>>
>> - io_provide_buffers() drops a ref from req->refs, which should've
>> been used by iopoll*. E.g. io_complete_rw_iopoll() doesn't do that.
>>
>> - it doesn't set REQ_F_IOPOLL_COMPLETED, thus iopoll* side will
>> call req->file->iopoll().
> 
> We don't poll for provide/remove buffers, or file update. The
> completion is done inline. The REQ_F_IOPOLL_COMPLETED and friends
> is only applicable on read/writes.
> 

1. Let io_provide_buffers() succeeds, putting a ref and returning 0

2. io_issue_sqe() on the way back do IORING_SETUP_IOPOLL check,
where it calls io_iopoll_req_issued(req)

3. io_iopoll_req_issued() unconditionally adds the req into ->poll_list

4. io_do_iopoll() checks the req, doesn't find it flagged with
REQ_F_IOPOLL_COMPLETED, and tries req->file->iopoll().


Do I miss something? Just did a quick and dirty test, which segfaulted.
Not certain about it though.

-- 
Pavel Begunkov