@@ -374,6 +374,8 @@ struct io_ring_ctx {
unsigned sq_thread_idle;
/* protected by ->completion_lock */
unsigned evfd_last_cq_tail;
+
+ struct completion *exit_comp;
};
struct io_tw_state {
@@ -3068,6 +3068,9 @@ static __cold void io_ring_exit_work(struct work_struct *work)
*/
} while (!wait_for_completion_interruptible_timeout(&ctx->ref_comp, interval));
+ if (ctx->exit_comp)
+ complete(ctx->exit_comp);
+
init_completion(&exit.completion);
init_task_work(&exit.task_work, io_tctx_exit_cb);
exit.ctx = ctx;
@@ -3116,6 +3119,8 @@ static __cold void io_ring_ctx_wait_and_kill(struct io_ring_ctx *ctx)
mutex_lock(&ctx->uring_lock);
io_ring_ref_kill(ctx);
+ if (current->io_uring)
+ io_fallback_tw(current->io_uring, false);
xa_for_each(&ctx->personalities, index, creds)
io_unregister_personality(ctx, index);
if (ctx->rings)
@@ -3144,9 +3149,20 @@ static __cold void io_ring_ctx_wait_and_kill(struct io_ring_ctx *ctx)
static int io_uring_release(struct inode *inode, struct file *file)
{
struct io_ring_ctx *ctx = file->private_data;
+ DECLARE_COMPLETION_ONSTACK(exit_comp);
file->private_data = NULL;
+ WRITE_ONCE(ctx->exit_comp, &exit_comp);
io_ring_ctx_wait_and_kill(ctx);
+
+ /*
+ * Wait for cancel to run before exiting task
+ */
+ do {
+ if (current->io_uring)
+ io_fallback_tw(current->io_uring, false);
+ } while (wait_for_completion_interruptible(&exit_comp));
+
return 0;
}
We still offload the cancelation to a workqueue, as not to introduce dependencies between the exiting task waiting on cleanup, and that task needing to run task_work to complete the process. This means that once the final ring put is done, any request that was inflight and needed cancelation will be done as well. Notably requests that hold references to files - once the ring fd close is done, we will have dropped any of those references too. Signed-off-by: Jens Axboe <axboe@kernel.dk> --- include/linux/io_uring_types.h | 2 ++ io_uring/io_uring.c | 16 ++++++++++++++++ 2 files changed, 18 insertions(+)