[PATCH] io_uring: only wait for in-flight requests if the closing task uses the ring

[PATCH] io_uring: only wait for in-flight requests if the closing task uses the ring

[orkunsari via B4 Relay]

From: orkunsari <sariorkunemin@gmail.com>

Since commit 13d3783a55b7 ("io_uring: wait for in-flight requests on
ring release"), the task dropping the last reference to a ring file
waits in io_ring_ctx_wait_inflight() until every request on the ring
has completed, and only a fatal signal ends the wait early.  The
requests may belong to other tasks and may not complete for an
unbounded time, e.g. a read on a FUSE file whose server never replies.
A process that merely received the ring fd over a UNIX socket and
closes it then blocks in close(2) for as long as those requests stay
in flight.

The comment in io_ring_ctx_wait_and_kill() states that the wait is
meant for requests owned by the task closing the ring.  Only tasks that
created or submitted to a ring have a node for it in their
io_uring_task, so skip the wait for any other task and leave the
remaining requests to io_ring_exit_work() as before.

A thread of the same process that never attached to the ring no longer
waits either when it drops the last reference.  A task that is attached
can still be held up by requests submitted by other tasks; that case
is not addressed here.

This was found by AI-assisted code review (Claude Code).  The fix has
been build-tested with W=1 only; no reproducer was run.

Fixes: 13d3783a55b7 ("io_uring: wait for in-flight requests on ring release")
Signed-off-by: orkunsari <sariorkunemin@gmail.com>
---
Regression in v7.4-rc1 only; released kernels are not affected.
---
 io_uring/io_uring.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index 03724419c4..04e3da5de0 100644
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -2547,7 +2547,16 @@ static __cold void io_ring_ctx_wait_inflight(struct io_ring_ctx *ctx)
 
 	if (current->flags & (PF_KTHREAD | PF_EXITING))
 		return;
-	if (tctx && atomic_read(&tctx->in_cancel))
+	/*
+	 * Tasks that have attached to this ring (created it, submitted to it,
+	 * registered its fd, ...) have a node for it in their io_uring_task.
+	 * A task without one owns no requests here, e.g. one that received
+	 * the fd over a socket, and must not be made to wait for requests it
+	 * has no control over.
+	 */
+	if (!tctx || !xa_load(&tctx->xa, (unsigned long)ctx))
+		return;
+	if (atomic_read(&tctx->in_cancel))
 		return;
 
 	while (io_ring_ctx_inflight(ctx) && !fatal_signal_pending(current)) {

---
base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
change-id: 20261104-io-uring-wait-inflight-5ff78a7c6cd5

Best regards,
--  
orkunsari <sariorkunemin@gmail.com>

Re: [PATCH] io_uring: only wait for in-flight requests if the closing task uses the ring

[Jens Axboe]

On 11/4/26 4:56 AM, orkunsari via B4 Relay wrote:
> From: orkunsari <sariorkunemin@gmail.com>
> 
> Since commit 13d3783a55b7 ("io_uring: wait for in-flight requests on
> ring release"), the task dropping the last reference to a ring file
> waits in io_ring_ctx_wait_inflight() until every request on the ring
> has completed, and only a fatal signal ends the wait early.  The
> requests may belong to other tasks and may not complete for an
> unbounded time, e.g. a read on a FUSE file whose server never replies.
> A process that merely received the ring fd over a UNIX socket and
> closes it then blocks in close(2) for as long as those requests stay
> in flight.
> 
> The comment in io_ring_ctx_wait_and_kill() states that the wait is
> meant for requests owned by the task closing the ring.  Only tasks that
> created or submitted to a ring have a node for it in their
> io_uring_task, so skip the wait for any other task and leave the
> remaining requests to io_ring_exit_work() as before.
> 
> A thread of the same process that never attached to the ring no longer
> waits either when it drops the last reference.  A task that is attached
> can still be held up by requests submitted by other tasks; that case
> is not addressed here.

Fix looks fine, few things to sort out on your end:

> This was found by AI-assisted code review (Claude Code).  The fix has
> been build-tested with W=1 only; no reproducer was run.

Just drop this.

Also fix silly double spaces in commit message, thanks LLM, and
verbosity is also overkill.

Signed-off-by is a legal contract, use a real identity, not some
handle.

> @@ -2547,7 +2547,16 @@ static __cold void io_ring_ctx_wait_inflight(struct io_ring_ctx *ctx)
>  
>  	if (current->flags & (PF_KTHREAD | PF_EXITING))
>  		return;
> -	if (tctx && atomic_read(&tctx->in_cancel))
> +	/*
> +	 * Tasks that have attached to this ring (created it, submitted to it,
> +	 * registered its fd, ...) have a node for it in their io_uring_task.
> +	 * A task without one owns no requests here, e.g. one that received
> +	 * the fd over a socket, and must not be made to wait for requests it
> +	 * has no control over.
> +	 */
> +	if (!tctx || !xa_load(&tctx->xa, (unsigned long)ctx))
> +		return;
> +	if (atomic_read(&tctx->in_cancel))

Similarly, this comment is way too long. Cut it down.

Resend with those things fixed, thanks.

-- 
Jens Axboe