[PATCH v2] io_uring: only wait for in-flight requests if the closing task uses the ring

[Orkun Emin Sarı via B4 Relay]

From: Orkun Emin Sarı <sariorkunemin@xxxxxxxxx>

Since commit 13d3783a55b7 ("io_uring: wait for in-flight requests on
ring release"), the task dropping the last reference to a ring waits
for every request on it to complete. A process that only received the
ring fd, e.g. over a UNIX socket, can then block in close(2) on
requests owned by other tasks, such as a read from an unresponsive
FUSE server.

Skip the wait for tasks that never attached to the ring and leave those
requests to io_ring_exit_work(), as before.

Fixes: 13d3783a55b7 ("io_uring: wait for in-flight requests on ring release")
Signed-off-by: Orkun Emin Sarı <sariorkunemin@xxxxxxxxx>
---
Changes in v2:
- Shorten the commit message and the code comment
- Use real name in Signed-off-by
- Link to v1: https://patch.msgid.link/20261104-io-uring-wait-inflight-v1-1-4361a0905e20@xxxxxxxxx
---
 io_uring/io_uring.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index 03724419c4..5db57bf675 100644
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -2547,7 +2547,10 @@ static __cold void io_ring_ctx_wait_inflight(struct io_ring_ctx *ctx)
 
 	if (current->flags & (PF_KTHREAD | PF_EXITING))
 		return;
-	if (tctx && atomic_read(&tctx->in_cancel))
+	/* Only wait if this task has attached to the ring */
+	if (!tctx || !xa_load(&tctx->xa, (unsigned long)ctx))
+		return;
+	if (atomic_read(&tctx->in_cancel))
 		return;
 
 	while (io_ring_ctx_inflight(ctx) && !fatal_signal_pending(current)) {

---
base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
change-id: 20261104-io-uring-wait-inflight-5ff78a7c6cd5

Best regards,
--  
Orkun Emin Sarı <sariorkunemin@xxxxxxxxx>