From: Al Viro <viro@zeniv.linux.org.uk>
To: Jens Axboe <axboe@kernel.dk>
Cc: Pavel Begunkov <asml.silence@gmail.com>,
io-uring@vger.kernel.org, linux-fsdevel@vger.kernel.org,
Linus Torvalds <torvalds@linux-foundation.org>
Subject: Re: [PATCH 3/3] io_uring: refactor io_sq_offload_create()
Date: Thu, 22 Jul 2021 23:30:35 +0000 [thread overview]
Message-ID: <YPn/m56w86xAlbIm@zeniv-ca.linux.org.uk> (raw)
In-Reply-To: <57758edf-d064-d37e-e544-e0c72299823d@kernel.dk>
On Thu, Jul 22, 2021 at 05:06:24PM -0600, Jens Axboe wrote:
> But yes, that is not great and obviously a bug, and we'll of course get
> it fixed up asap.
Another fun question: in do_exit() you have
io_uring_files_cancel(tsk->files);
with
static inline void io_uring_files_cancel(struct files_struct *files)
{
if (current->io_uring)
__io_uring_cancel(files);
}
and
void __io_uring_cancel(struct files_struct *files)
{
io_uring_cancel_generic(!files, NULL);
}
What the hell is that about? What are you trying to check there?
All assignments to ->files:
init/init_task.c:116: .files = &init_files,
Not NULL.
fs/file.c:433: tsk->files = NULL;
exit_files(), sets to NULL
fs/file.c:741: me->files = cur_fds;
__close_range(), if the value has been changed at all, the new one
came from if (fds) swap(cur_fds, fds), so it can't become NULL here.
kernel/fork.c:1482: tsk->files = newf;
copy_files(), immediately preceded by verifying newf != NULL
kernel/fork.c:3044: current->files = new_fd;
ksys_unshare(), under if (new_fd)
kernel/fork.c:3097: task->files = copy;
unshare_files(), with if (error || !copy) return error;
slightly upstream.
IOW, task->files can be NULL *ONLY* after exit_files(). There are two callers
of that; one is for stillborns in copy_process(), another - in do_exit(),
well past that call of io_uring_files_cancel(). And around that call we have
if (unlikely(tsk->flags & PF_EXITING)) {
pr_alert("Fixing recursive fault but reboot is needed!\n");
futex_exit_recursive(tsk);
set_current_state(TASK_UNINTERRUPTIBLE);
schedule();
}
io_uring_files_cancel(tsk->files);
exit_signals(tsk); /* sets PF_EXITING */
So how can we possibly get there with tsk->files == NULL and what does it
have to do with files, anyway?
next prev parent reply other threads:[~2021-07-22 23:30 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-04-20 11:03 [PATCH 0/3] small 5.13 cleanups Pavel Begunkov
2021-04-20 11:03 ` [PATCH 1/3] io_uring: move inflight un-tracking into cleanup Pavel Begunkov
2021-04-20 11:03 ` [PATCH 2/3] io_uring: safer sq_creds putting Pavel Begunkov
2021-04-20 11:03 ` [PATCH 3/3] io_uring: refactor io_sq_offload_create() Pavel Begunkov
2021-07-22 21:59 ` Al Viro
2021-07-22 23:06 ` Jens Axboe
2021-07-22 23:30 ` Al Viro [this message]
2021-07-22 23:42 ` Jens Axboe
2021-07-23 0:10 ` Al Viro
2021-07-23 0:12 ` Al Viro
2021-07-23 16:17 ` Jens Axboe
2021-07-23 17:11 ` Al Viro
2021-07-23 17:32 ` Jens Axboe
2021-07-23 17:36 ` Jens Axboe
2021-07-23 17:56 ` Jens Axboe
2021-07-23 19:00 ` Al Viro
2021-07-23 20:10 ` Jens Axboe
2021-07-23 20:24 ` Al Viro
2021-07-23 22:32 ` Jens Axboe
2021-07-23 20:19 ` Al Viro
2021-07-23 23:45 ` Matthew Wilcox
2021-07-23 23:57 ` Jens Axboe
2021-07-24 1:31 ` Al Viro
2021-07-23 0:03 ` Al Viro
2021-07-23 9:59 ` Pavel Begunkov
2021-04-20 18:55 ` [PATCH 0/3] small 5.13 cleanups Jens Axboe
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YPn/m56w86xAlbIm@zeniv-ca.linux.org.uk \
--to=viro@zeniv.linux.org.uk \
--cc=asml.silence@gmail.com \
--cc=axboe@kernel.dk \
--cc=io-uring@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.