From: Pavel Begunkov <asml.silence@gmail.com>
To: Jens Axboe <axboe@kernel.dk>, io-uring@vger.kernel.org
Subject: [PATCH 01/10] io_uring: fix refs underflow in io_iopoll_queue()
Date: Sun, 28 Jun 2020 12:52:29 +0300 [thread overview]
Message-ID: <8122af4ead0571f80143c3509d71cae16b17535a.1593337097.git.asml.silence@gmail.com> (raw)
In-Reply-To: <cover.1593337097.git.asml.silence@gmail.com>
Now io_complete_rw_common() puts a ref, extra io_req_put()
in io_iopoll_queue() causes undeflow. Remove it.
[ 455.998620] refcount_t: underflow; use-after-free.
[ 455.998743] WARNING: CPU: 6 PID: 285394 at lib/refcount.c:28
refcount_warn_saturate+0xae/0xf0
[ 455.998772] CPU: 6 PID: 285394 Comm: read-write2 Tainted: G
I E 5.8.0-rc2-00048-g1b1aa738f167-dirty #509
[ 455.998772] RIP: 0010:refcount_warn_saturate+0xae/0xf0
...
[ 455.998778] Call Trace:
[ 455.998778] io_put_req+0x44/0x50
[ 455.998778] io_iopoll_complete+0x245/0x370
[ 455.998779] io_iopoll_getevents+0x12f/0x1a0
[ 455.998779] io_iopoll_reap_events.part.0+0x5e/0xa0
[ 455.998780] io_ring_ctx_wait_and_kill+0x132/0x1c0
[ 455.998780] io_uring_release+0x20/0x30
[ 455.998780] __fput+0xcd/0x230
[ 455.998781] ____fput+0xe/0x10
[ 455.998781] task_work_run+0x67/0xa0
[ 455.998781] do_exit+0x35d/0xb70
[ 455.998782] do_group_exit+0x43/0xa0
[ 455.998783] get_signal+0x140/0x900
[ 455.998783] do_signal+0x37/0x780
[ 455.998784] __prepare_exit_to_usermode+0x126/0x1c0
[ 455.998785] __syscall_return_slowpath+0x3b/0x1c0
[ 455.998785] do_syscall_64+0x5f/0xa0
[ 455.998785] entry_SYSCALL_64_after_hwframe+0x44/0xa9
Fixes: a1d7c393c47 ("io_uring: enable READ/WRITE to use deferred completions")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
---
fs/io_uring.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/fs/io_uring.c b/fs/io_uring.c
index bf236ba10601..52441f2465fe 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -1904,7 +1904,6 @@ static void io_iopoll_queue(struct list_head *again)
/* shouldn't happen unless io_uring is dying, cancel reqs */
if (unlikely(!current->mm)) {
io_complete_rw_common(&req->rw.kiocb, -EAGAIN, NULL);
- io_put_req(req);
continue;
}
--
2.24.0
next prev parent reply other threads:[~2020-06-28 9:54 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-06-28 9:52 [PATCH 00/10] some fixing + refactoring batch-free Pavel Begunkov
2020-06-28 9:52 ` Pavel Begunkov [this message]
2020-06-28 9:52 ` [PATCH 02/10] io_uring: remove inflight batching in free_many() Pavel Begunkov
2020-06-28 9:52 ` [PATCH 03/10] io_uring: dismantle req early and remove need_iter Pavel Begunkov
2020-06-28 9:52 ` [PATCH 04/10] io_uring: batch-free linked reqs as well Pavel Begunkov
2020-06-28 9:52 ` [PATCH 05/10] io_uring: cosmetic changes for batch free Pavel Begunkov
2020-06-28 9:52 ` [PATCH 06/10] io_uring: kill REQ_F_LINK_NEXT Pavel Begunkov
2020-06-28 9:52 ` [PATCH 07/10] io_uring: clean up req->result setting by rw Pavel Begunkov
2020-06-28 9:52 ` [PATCH 08/10] io_uring: fix missing wake_up io_rw_reissue() Pavel Begunkov
2020-06-28 14:12 ` Jens Axboe
2020-06-28 14:48 ` Pavel Begunkov
2020-06-28 9:52 ` [PATCH 09/10] io_uring: do task_work_run() during iopoll Pavel Begunkov
2020-06-28 9:52 ` [PATCH 10/10] io_uring: fix iopoll -EAGAIN handling Pavel Begunkov
2020-06-28 14:09 ` [PATCH 00/10] some fixing + refactoring batch-free Jens Axboe
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=8122af4ead0571f80143c3509d71cae16b17535a.1593337097.git.asml.silence@gmail.com \
--to=asml.silence@gmail.com \
--cc=axboe@kernel.dk \
--cc=io-uring@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).