possible bug: duplicate completion events with the same userdata id

[romange]

Given that 'io_uring_cqe.user_data' is the only field that synchronizes completion and its submit request I assume it's very important that no completion event should return twice.

My setup: linux 5.6.2-050602-generic. I test correctness of the system under stress, simulating resource exhaustion scenarios with single thread operating io_uring with 32 depth size.

Each user_data id is unique and is set and incremented upon successful call from io_uring_get_sqe(&ring_):

sqe = io_uring_get_sqe(&ring_);
CHECK(sqe != NULL);
sqe->user_data = my_global_id++;

Upon a completion I verify user_data vs global hashset with already seen user_data ids and check-fail if it's something I already got. Very often (non-determenistically) I get a batch of completions that I've already seen.

It happens only if ring is small enough and I get EBUSY error upon io_uring_submit() call at some point. I am not sure if it's the root cause or just coincedence but I could not reproduce it with ring size 128 or more. I use IORING_OP_POLL_ADD and IORING_OP_READ with sockets (not that I think it matters).

I can attach the run log demonstrating that somehow I get a batch of completions that repeat themselves.

[romange]

duplicate.log
The format : localindex/userdata_id <iouring opcode>/<socket fd>

localindex it's just an index in io_uring_cqe** array upon returning from io_uring_peek_batch_cqe between 0 and 31.
As you can see in the log, cqe with userdata_id=698 has been already returned at line 571.

[romange]

my uring loop is:

while(true) {
  io_uring_submit(&ring_);
  somecpu_work();
  if (count = io_uring_peek_batch_cqe(ring,cqes, 32)) {
    ProcessCompletions(cqes, count);
    io_uring_cq_advance(ring, count);
    continue;
  }
  io_uring_wait_cqe(ring, &tmp_cqe_ptr);
}

[romange]

It seems indeed that there is an edge case in case io_uring_submit returns a retriable error.
liburing library changes the state and "looses" the submitted entitites.
The fix is to store sq.sqe_head before io_uring_submit call and restore it back in case of such error.

For example,

auto head = sq.sqe_head;
int res = io_uring_submit(&ring_);
if (res == -EBUSY) {
  sq.sqe_head = head;
}
...

@axboe FYI