IoUringDynamicProvidedBufferRing: fix empty-ring area handoff

Summary:
When the dynamic provided buffer ring reaches its area limit while buffers are
still held, the kernel ring can drain completely. If an older area subsequently
becomes reusable, refill selects it as `bufferRefillArea_`, but
`bufferActiveArea_` remains on the previously exhausted area because no
completion remains to perform the normal end-of-area handoff.

The next completion then wraps memory from the stale active area instead of the
area posted to the kernel. Returns are also charged to the wrong area, which can
allow an area with live IOBufs to be reclaimed.

When refilling an empty ring, make the selected refill area active before
publishing its descriptors.

Reviewed By: jlhe97

Differential Revision: D116800599

fbshipit-source-id: fcb815fa1ae1afa5323e1ae4bdd7ceb8f5cf3908

Author: spikeh

third-party/folly/src/folly/io/async/IoUringDynamicProvidedBufferRing.cpp

@@ -272,6 +272,10 @@ void IoUringDynamicProvidedBufferRing::ringRefill() noexcept {
     return;
   }
 
+  if (ringFillLevel() == 0) {
+    bufferActiveArea_ = bufferRefillArea_;
+  }
+
   uint16_t pendingOutstanding = 0;
   auto freeEntries = ringFreeEntries();
   while (freeEntries--) {

third-party/folly/src/folly/io/async/test/IoUringDynamicProvidedBufferRingTest.cpp

@@ -57,6 +57,10 @@ class IoUringDynamicProvidedBufferRingTestHelper {
   uint32_t ringAvailable() { return ring.ringTail_ - ring.ringHead_; }
   uint64_t outstandingSum() { return ring.areasOutstandingSum(); }
   uint16_t headBid() { return ring.ringBuf(ring.ringHead_)->bid; }
+  const unsigned char* headAddr() {
+    return reinterpret_cast<const unsigned char*>(
+        ring.ringBuf(ring.ringHead_)->addr);
+  }
 
   void setRingRefillThreshold(uint16_t threshold) {
     ring.ringRefillThreshold_ = threshold;
@@ -725,4 +729,35 @@ TEST_F(
       << "threshold consumption should trigger a batched refill";
 }
 
+TEST_F(
+    IoUringDynamicProvidedBufferRingTest, RefillAfterAreaCapUsesRecycledArea) {
+  io_uring ring{};
+  io_uring_queue_init(512, &ring, 0);
+  IoUringDynamicProvidedBufferRing::Options options = {
+      .gid = 1,
+      .bufferCount = 2,
+      .bufferSize = 64,
+  };
+  auto bufRing = IoUringDynamicProvidedBufferRing::create(&ring, options);
+  IoUringDynamicProvidedBufferRingTestHelper helper(*bufRing);
+
+  std::vector<std::unique_ptr<folly::IOBuf>> held;
+  for (int i = 0; i < 1000 && helper.ringAvailable() > 0; i++) {
+    held.push_back(consumeOne(*bufRing, helper, 64));
+  }
+  ASSERT_EQ(helper.areaCount(), 64u);
+  ASSERT_EQ(helper.ringAvailable(), 0u);
+
+  held.erase(held.begin(), held.begin() + options.bufferCount);
+
+  bufRing->enobuf();
+  ASSERT_EQ(helper.ringAvailable(), options.bufferCount);
+
+  for (uint32_t i = 0; i < options.bufferCount; i++) {
+    const auto* posted = helper.headAddr();
+    auto buf = consumeOne(*bufRing, helper, 64);
+    EXPECT_EQ(buf->data(), posted);
+  }
+}
+
 #endif