io-uring.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH 0/2] random fixes
@ 2021-02-20  1:39 Pavel Begunkov
  2021-02-20  1:39 ` [PATCH 1/2] io_uring: wait potential ->release() on resurrect Pavel Begunkov
  2021-02-20  1:39 ` [PATCH 2/2] io_uring: fix leaving invalid req->flags Pavel Begunkov
  0 siblings, 2 replies; 7+ messages in thread
From: Pavel Begunkov @ 2021-02-20  1:39 UTC (permalink / raw)
  To: Jens Axboe, io-uring

Just two unrelated fixes batched together.

Pavel Begunkov (2):
  io_uring: wait potential ->release() on resurrect
  io_uring: fix leaving invalid req->flags

 fs/io_uring.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

-- 
2.24.0


^ permalink raw reply	[flat|nested] 7+ messages in thread

* [PATCH 1/2] io_uring: wait potential ->release() on resurrect
  2021-02-20  1:39 [PATCH 0/2] random fixes Pavel Begunkov
@ 2021-02-20  1:39 ` Pavel Begunkov
  2021-02-20  3:40   ` Jens Axboe
  2021-02-20  1:39 ` [PATCH 2/2] io_uring: fix leaving invalid req->flags Pavel Begunkov
  1 sibling, 1 reply; 7+ messages in thread
From: Pavel Begunkov @ 2021-02-20  1:39 UTC (permalink / raw)
  To: Jens Axboe, io-uring; +Cc: stable

There is a short window where percpu_refs are already turned zero, but
we try to do resurrect(). Play nicer and wait for all users to leave RCU
section.

Cc: <stable@vger.kernel.org> # 5.5+
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
---
 fs/io_uring.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/io_uring.c b/fs/io_uring.c
index f3af499b12a9..ce5fccf00367 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -7351,6 +7351,7 @@ static int io_rsrc_ref_quiesce(struct fixed_rsrc_data *data,
 			break;
 
 		percpu_ref_resurrect(&data->refs);
+		synchronize_rcu();
 		io_sqe_rsrc_set_node(ctx, data, backup_node);
 		reinit_completion(&data->done);
 		mutex_unlock(&ctx->uring_lock);
@@ -10089,6 +10090,7 @@ static int __io_uring_register(struct io_ring_ctx *ctx, unsigned opcode,
 
 		if (ret) {
 			percpu_ref_resurrect(&ctx->refs);
+			synchronize_rcu();
 			goto out_quiesce;
 		}
 	}
-- 
2.24.0


^ permalink raw reply related	[flat|nested] 7+ messages in thread

* [PATCH 2/2] io_uring: fix leaving invalid req->flags
  2021-02-20  1:39 [PATCH 0/2] random fixes Pavel Begunkov
  2021-02-20  1:39 ` [PATCH 1/2] io_uring: wait potential ->release() on resurrect Pavel Begunkov
@ 2021-02-20  1:39 ` Pavel Begunkov
  2021-02-20  4:17   ` Jens Axboe
  1 sibling, 1 reply; 7+ messages in thread
From: Pavel Begunkov @ 2021-02-20  1:39 UTC (permalink / raw)
  To: Jens Axboe, io-uring

sqe->flags are subset of req flags, so incorrectly copied may span into
in-kernel flags and wreck havoc, e.g. by setting REQ_F_INFLIGHT.

Fixes: 5be9ad1e4287e ("io_uring: optimise io_init_req() flags setting")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
---
 fs/io_uring.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/io_uring.c b/fs/io_uring.c
index ce5fccf00367..2bd10f89b837 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -6687,8 +6687,10 @@ static int io_init_req(struct io_ring_ctx *ctx, struct io_kiocb *req,
 	req->result = 0;
 
 	/* enforce forwards compatibility on users */
-	if (unlikely(sqe_flags & ~SQE_VALID_FLAGS))
+	if (unlikely(sqe_flags & ~SQE_VALID_FLAGS)) {
+		req->flags = 0;
 		return -EINVAL;
+	}
 
 	if (unlikely(req->opcode >= IORING_OP_LAST))
 		return -EINVAL;
-- 
2.24.0


^ permalink raw reply related	[flat|nested] 7+ messages in thread

* Re: [PATCH 1/2] io_uring: wait potential ->release() on resurrect
  2021-02-20  1:39 ` [PATCH 1/2] io_uring: wait potential ->release() on resurrect Pavel Begunkov
@ 2021-02-20  3:40   ` Jens Axboe
  2021-02-20  3:47     ` Pavel Begunkov
  0 siblings, 1 reply; 7+ messages in thread
From: Jens Axboe @ 2021-02-20  3:40 UTC (permalink / raw)
  To: Pavel Begunkov, io-uring; +Cc: stable

On 2/19/21 6:39 PM, Pavel Begunkov wrote:
> There is a short window where percpu_refs are already turned zero, but
> we try to do resurrect(). Play nicer and wait for all users to leave RCU
> section.

We need to do something better than synchronize_rcu() here, that can
take a long time on a loaded box. I'll try and think about this one.

-- 
Jens Axboe


^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: [PATCH 1/2] io_uring: wait potential ->release() on resurrect
  2021-02-20  3:40   ` Jens Axboe
@ 2021-02-20  3:47     ` Pavel Begunkov
  2021-02-20  3:53       ` Jens Axboe
  0 siblings, 1 reply; 7+ messages in thread
From: Pavel Begunkov @ 2021-02-20  3:47 UTC (permalink / raw)
  To: Jens Axboe, io-uring; +Cc: stable

On 20/02/2021 03:40, Jens Axboe wrote:
> On 2/19/21 6:39 PM, Pavel Begunkov wrote:
>> There is a short window where percpu_refs are already turned zero, but
>> we try to do resurrect(). Play nicer and wait for all users to leave RCU
>> section.
> 
> We need to do something better than synchronize_rcu() here, that can
> take a long time on a loaded box. I'll try and think about this one.

It only happens when it can't be drained and there are task_works or
signals. I have another patch, doing it via tryget, but it's uglier and
I'd rather prefer synchronize_rcu for stable.

Want me to send it tomorrow (on top or not)?

-- 
Pavel Begunkov

^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: [PATCH 1/2] io_uring: wait potential ->release() on resurrect
  2021-02-20  3:47     ` Pavel Begunkov
@ 2021-02-20  3:53       ` Jens Axboe
  0 siblings, 0 replies; 7+ messages in thread
From: Jens Axboe @ 2021-02-20  3:53 UTC (permalink / raw)
  To: Pavel Begunkov, io-uring; +Cc: stable

On 2/19/21 8:47 PM, Pavel Begunkov wrote:
> On 20/02/2021 03:40, Jens Axboe wrote:
>> On 2/19/21 6:39 PM, Pavel Begunkov wrote:
>>> There is a short window where percpu_refs are already turned zero, but
>>> we try to do resurrect(). Play nicer and wait for all users to leave RCU
>>> section.
>>
>> We need to do something better than synchronize_rcu() here, that can
>> take a long time on a loaded box. I'll try and think about this one.
> 
> It only happens when it can't be drained and there are task_works or
> signals. I have another patch, doing it via tryget, but it's uglier and
> I'd rather prefer synchronize_rcu for stable.

Right, but the task_work coming in may not be unlikely. So it's not
strictly an error path.

-- 
Jens Axboe


^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: [PATCH 2/2] io_uring: fix leaving invalid req->flags
  2021-02-20  1:39 ` [PATCH 2/2] io_uring: fix leaving invalid req->flags Pavel Begunkov
@ 2021-02-20  4:17   ` Jens Axboe
  0 siblings, 0 replies; 7+ messages in thread
From: Jens Axboe @ 2021-02-20  4:17 UTC (permalink / raw)
  To: Pavel Begunkov, io-uring

On 2/19/21 6:39 PM, Pavel Begunkov wrote:
> sqe->flags are subset of req flags, so incorrectly copied may span into
> in-kernel flags and wreck havoc, e.g. by setting REQ_F_INFLIGHT.

Applied, thanks.

-- 
Jens Axboe


^ permalink raw reply	[flat|nested] 7+ messages in thread

end of thread, other threads:[~2021-02-20  4:18 UTC | newest]

Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-02-20  1:39 [PATCH 0/2] random fixes Pavel Begunkov
2021-02-20  1:39 ` [PATCH 1/2] io_uring: wait potential ->release() on resurrect Pavel Begunkov
2021-02-20  3:40   ` Jens Axboe
2021-02-20  3:47     ` Pavel Begunkov
2021-02-20  3:53       ` Jens Axboe
2021-02-20  1:39 ` [PATCH 2/2] io_uring: fix leaving invalid req->flags Pavel Begunkov
2021-02-20  4:17   ` Jens Axboe

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).