io-wq: fix IO_WORKER_F_FIXED issue in create_io_worker()

There may be cases like:
        A                                 B
spin_lock(wqe->lock)
nr_workers is 0
nr_workers++
spin_unlock(wqe->lock)
                                     spin_lock(wqe->lock)
                                     nr_wokers is 1
                                     nr_workers++
                                     spin_unlock(wqe->lock)
create_io_worker()
  acct->worker is 1
                                     create_io_worker()
                                       acct->worker is 1

There should be one worker marked IO_WORKER_F_FIXED, but no one is.
Fix this by introduce a new agrument for create_io_worker() to indicate
if it is the first worker.

Fixes: 3d4e4face9c1 ("io-wq: fix no lock protection of acct->nr_worker")
Signed-off-by: Hao Xu <haoxu@linux.alibaba.com>
Link: https://lore.kernel.org/r/20210808135434.68667-3-haoxu@linux.alibaba.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/fs/io-wq.c b/fs/io-wq.c
index ac8604a3516992a20f52cc7e22aa71821c0fb96d..7d2ed8c7dd3128412138d2c26b6b364ca4870040 100644 (file)
--- a/fs/io-wq.c
+++ b/fs/io-wq.c
@@ -129,7 +129,7 @@ struct io_cb_cancel_data {
        bool cancel_all;
 };
 
-static void create_io_worker(struct io_wq *wq, struct io_wqe *wqe, int index);
+static void create_io_worker(struct io_wq *wq, struct io_wqe *wqe, int index, bool first);
 static void io_wqe_dec_running(struct io_worker *worker);
 
 static bool io_worker_get(struct io_worker *worker)
@@ -248,18 +248,20 @@ static void io_wqe_wake_worker(struct io_wqe *wqe, struct io_wqe_acct *acct)
        rcu_read_unlock();
 
        if (!ret) {
-               bool do_create = false;
+               bool do_create = false, first = false;
 
                raw_spin_lock_irq(&wqe->lock);
                if (acct->nr_workers < acct->max_workers) {
                        atomic_inc(&acct->nr_running);
                        atomic_inc(&wqe->wq->worker_refs);
+                       if (!acct->nr_workers)
+                               first = true;
                        acct->nr_workers++;
                        do_create = true;
                }
                raw_spin_unlock_irq(&wqe->lock);
                if (do_create)
-                       create_io_worker(wqe->wq, wqe, acct->index);
+                       create_io_worker(wqe->wq, wqe, acct->index, first);
        }
 }
 
@@ -282,7 +284,7 @@ static void create_worker_cb(struct callback_head *cb)
        struct io_wq *wq;
        struct io_wqe *wqe;
        struct io_wqe_acct *acct;
-       bool do_create = false;
+       bool do_create = false, first = false;
 
        cwd = container_of(cb, struct create_worker_data, work);
        wqe = cwd->wqe;
@@ -290,12 +292,14 @@ static void create_worker_cb(struct callback_head *cb)
        acct = &wqe->acct[cwd->index];
        raw_spin_lock_irq(&wqe->lock);
        if (acct->nr_workers < acct->max_workers) {
+               if (!acct->nr_workers)
+                       first = true;
                acct->nr_workers++;
                do_create = true;
        }
        raw_spin_unlock_irq(&wqe->lock);
        if (do_create) {
-               create_io_worker(wq, cwd->wqe, cwd->index);
+               create_io_worker(wq, wqe, cwd->index, first);
        } else {
                atomic_dec(&acct->nr_running);
                io_worker_ref_put(wq);
@@ -637,7 +641,7 @@ void io_wq_worker_sleeping(struct task_struct *tsk)
        raw_spin_unlock_irq(&worker->wqe->lock);
 }
 
-static void create_io_worker(struct io_wq *wq, struct io_wqe *wqe, int index)
+static void create_io_worker(struct io_wq *wq, struct io_wqe *wqe, int index, bool first)
 {
        struct io_wqe_acct *acct = &wqe->acct[index];
        struct io_worker *worker;
@@ -678,7 +682,7 @@ fail:
        worker->flags |= IO_WORKER_F_FREE;
        if (index == IO_WQ_ACCT_BOUND)
                worker->flags |= IO_WORKER_F_BOUND;
-       if ((acct->nr_workers == 1) && (worker->flags & IO_WORKER_F_BOUND))
+       if (first && (worker->flags & IO_WORKER_F_BOUND))
                worker->flags |= IO_WORKER_F_FIXED;
        raw_spin_unlock_irq(&wqe->lock);
        wake_up_new_task(tsk);