Root Cause Analysis

1. Relevant Subsystem, Functions, and State

• Source file: io_uring/sqpoll.c
• Functions involved: io_sq_thread(), io_sq_thread_stop(), io_put_sq_data(), io_sq_thread_finish(), io_sq_offload_create()
• Structures and fields: struct io_sq_data::state, IO_SQ_THREAD_SHOULD_STOP, struct io_sq_data::thread, struct io_sq_data::free_refs, struct io_sq_data::refs

2. Technical Mechanism

1. Previous Invariant and Design: In io_uring/sqpoll.c, struct io_sq_data coordinates the SQPOLL kernel thread shared by one or more io_ring_ctx instances. It maintains reference counts: sqd->refs counts how many rings reference the sqd, while sqd->free_refs counts holders (one for all rings collectively, one for the thread itself).

   Historically, io_sq_thread_stop(struct io_sq_data *sqd) was the sole place where the IO_SQ_THREAD_SHOULD_STOP flag on sqd->state was set:

   void io_sq_thread_stop(struct io_sq_data *sqd)
   {
       struct task_struct *tsk;
   
       WARN_ON_ONCE(test_bit(IO_SQ_THREAD_SHOULD_STOP, &sqd->state));
   
       set_bit(IO_SQ_THREAD_SHOULD_STOP, &sqd->state);
       mutex_lock(&sqd->lock);
       tsk = sqpoll_task_locked(sqd);
       if (tsk) {
           WARN_ON_ONCE(tsk == current);
           wake_up_process(tsk);
       }
       mutex_unlock(&sqd->lock);
   }
   

   Because io_sq_thread_stop() was only called once when the last ring dropped its reference in io_put_sq_data() (if (refcount_dec_and_test(&sqd->refs))), the assertion WARN_ON_ONCE(test_bit(IO_SQ_THREAD_SHOULD_STOP, &sqd->state)) checked that io_sq_thread_stop() had not been invoked before for this sqd.

2. The Introduction of the Conflict: To fix a race condition where a new ring attaches (IORING_SETUP_ATTACH_WQ) to an SQPOLL thread while that thread is exiting and canceling requests, commit 22d9db9fd64a ("io_uring/sqpoll: don't attach to a thread that is canceling") added logic to set IO_SQ_THREAD_SHOULD_STOP directly in io_sq_thread() when the thread breaks out of its work loop:

   /*
    * Cancelation drops sqd->lock while it waits, and a ring could attach
    * to a thread that is on its way out. A fatal signal doesn't set the
    * bit, so set it here for io_sq_offload_create() to see.
    */
   set_bit(IO_SQ_THREAD_SHOULD_STOP, &sqd->state);
   io_uring_cancel_generic(true, sqd);
   rcu_assign_pointer(sqd->thread, NULL);
   put_task_struct(current);
   ...
   err_out:
   io_sq_data_release(sqd);
   do_exit(0);
   

3. How the Bug is Triggered:

   • If an application using an SQPOLL ring receives a fatal signal (such as SIGKILL), the signal is delivered group-wide to both the user process and the SQPOLL thread.
   • In io_sq_thread(), io_sqd_handle_event() detects the pending signal via get_signal(&ksig) and returns true, causing io_sq_thread() to exit its main loop.
   • io_sq_thread() executes line 441: set_bit(IO_SQ_THREAD_SHOULD_STOP, &sqd->state), marks sqd->thread = NULL, releases its free_refs reference, and terminates.
   • Subsequently, during task teardown and file descriptor closure, io_ring_exit_work() runs on the iou_exit workqueue to destroy the io_ring_ctx.
   • io_ring_ctx_free() calls io_sq_thread_finish(), which drops the ring's reference to sqd via io_put_sq_data(sqd).
   • In io_put_sq_data(), refcount_dec_and_test(&sqd->refs) returns true and invokes io_sq_thread_stop(sqd).
   • Inside io_sq_thread_stop(), line 88 evaluates:

     WARN_ON_ONCE(test_bit(IO_SQ_THREAD_SHOULD_STOP, &sqd->state));
     

   • Since IO_SQ_THREAD_SHOULD_STOP was already set by io_sq_thread() when it exited, the check evaluates to true and fires the warning splat.