io_uring: fix assign file locking issue

[ Upstream commit 0f8da75b51ac863b9435368bd50691718cc454b0 ]

io-wq work cancellation path can't take uring_lock as how it's done on
file assignment, we have to handle IO_WQ_WORK_CANCEL first, this fixes
encountered hangs.

Fixes: 6bf9c47a3989 ("io_uring: defer file assignment")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/0d9b9f37841645518503f6a207e509d14a286aba.1649773463.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/fs/io_uring.c b/fs/io_uring.c
index d05394b0c1e6d53cb6e73d91bbca67435affc38e..e3d1fc95493368284e4a9cb8731faa9c0eb9ef4a 100644 (file)
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -6892,16 +6892,18 @@ static void io_wq_submit_work(struct io_wq_work *work)
        if (timeout)
                io_queue_linked_timeout(timeout);
 
-       if (!io_assign_file(req, issue_flags)) {
-               err = -EBADF;
-               work->flags |= IO_WQ_WORK_CANCEL;
-       }
 
        /* either cancelled or io-wq is dying, so don't touch tctx->iowq */
        if (work->flags & IO_WQ_WORK_CANCEL) {
+fail:
                io_req_task_queue_fail(req, err);
                return;
        }
+       if (!io_assign_file(req, issue_flags)) {
+               err = -EBADF;
+               work->flags |= IO_WQ_WORK_CANCEL;
+               goto fail;
+       }
 
        if (req->flags & REQ_F_FORCE_ASYNC) {
                bool opcode_poll = def->pollin || def->pollout;