io_uring: dont kill fasync under completion_lock

[ Upstream commit 4aa84f2ffa81f71e15e5cffc2cc6090dbee78f8e ]

      CPU0                    CPU1
       ----                    ----
  lock(&new->fa_lock);
                               local_irq_disable();
                               lock(&ctx->completion_lock);
                               lock(&new->fa_lock);
  <Interrupt>
    lock(&ctx->completion_lock);

 *** DEADLOCK ***

Move kill_fasync() out of io_commit_cqring() to io_cqring_ev_posted(),
so it doesn't hold completion_lock while doing it. That saves from the
reported deadlock, and it's just nice to shorten the locking time and
untangle nested locks (compl_lock -> wq_head::lock).

Cc: stable@vger.kernel.org # 5.5+
Reported-by: syzbot+91ca3f25bd7f795f019c@syzkaller.appspotmail.com
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 5018d4928d3e77feecf0a4f66c684b42d3bedded..d66afd3fe7ee9a8a4b313d3a5c9c8619ad28bcb4 100644 (file)
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -1214,11 +1214,6 @@ static void __io_commit_cqring(struct io_ring_ctx *ctx)
 
        /* order cqe stores with ring update */
        smp_store_release(&rings->cq.tail, ctx->cached_cq_tail);
-
-       if (wq_has_sleeper(&ctx->cq_wait)) {
-               wake_up_interruptible(&ctx->cq_wait);
-               kill_fasync(&ctx->cq_fasync, SIGIO, POLL_IN);
-       }
 }
 
 static void io_put_identity(struct io_uring_task *tctx, struct io_kiocb *req)
@@ -1604,6 +1599,10 @@ static inline bool io_should_trigger_evfd(struct io_ring_ctx *ctx)
 
 static void io_cqring_ev_posted(struct io_ring_ctx *ctx)
 {
+       if (wq_has_sleeper(&ctx->cq_wait)) {
+               wake_up_interruptible(&ctx->cq_wait);
+               kill_fasync(&ctx->cq_fasync, SIGIO, POLL_IN);
+       }
        if (waitqueue_active(&ctx->wait))
                wake_up(&ctx->wait);
        if (ctx->sq_data && waitqueue_active(&ctx->sq_data->wait))