[bug report] io_uring: ensure async punted read/write requests copy iovec

[bug report] io_uring: ensure async punted read/write requests copy iovec

[Dan Carpenter]

Hello Jens Axboe,

The patch f67676d160c6: "io_uring: ensure async punted read/write
requests copy iovec" from Dec 2, 2019, leads to the following static
checker warning:

	fs/io_uring.c:2919 io_req_defer()
	warn: inconsistent returns 'irq'.

fs/io_uring.c
  2891  static int io_req_defer(struct io_kiocb *req)
  2892  {
  2893          struct io_ring_ctx *ctx = req->ctx;
  2894          struct io_async_ctx *io;
  2895          int ret;
  2896  
  2897          /* Still need defer if there is pending req in defer list. */
  2898          if (!req_need_defer(req) && list_empty(&ctx->defer_list))
  2899                  return 0;
  2900  
  2901          io = kmalloc(sizeof(*io), GFP_KERNEL);
  2902          if (!io)
  2903                  return -EAGAIN;
  2904  
  2905          spin_lock_irq(&ctx->completion_lock);
  2906          if (!req_need_defer(req) && list_empty(&ctx->defer_list)) {
  2907                  spin_unlock_irq(&ctx->completion_lock);
  2908                  kfree(io);
  2909                  return 0;
  2910          }
  2911  
  2912          ret = io_req_defer_prep(req, io);
  2913          if (ret < 0)
  2914                  return ret;

We need to spin_unlock_irq(&ctx->completion_lock); before returning.
The question of if we need to kfree(io) is more complicated to me
because I'm not sure how kiocb->ki_complete gets called...

  2915  
  2916          trace_io_uring_defer(ctx, req, req->user_data);
  2917          list_add_tail(&req->list, &ctx->defer_list);
  2918          spin_unlock_irq(&ctx->completion_lock);
  2919          return -EIOCBQUEUED;
  2920  }

regards,
dan carpenter

Re: [bug report] io_uring: ensure async punted read/write requests copy iovec

[Dan Carpenter]

I see this was fixed in today's linux-next.  That was quick.  :)

regards,
dan caprenter


On Thu, Dec 05, 2019 at 02:00:35PM +0300, Dan Carpenter wrote:
> Hello Jens Axboe,
> 
> The patch f67676d160c6: "io_uring: ensure async punted read/write
> requests copy iovec" from Dec 2, 2019, leads to the following static
> checker warning:
> 
> 	fs/io_uring.c:2919 io_req_defer()
> 	warn: inconsistent returns 'irq'.
> 
> fs/io_uring.c
>   2891  static int io_req_defer(struct io_kiocb *req)
>   2892  {
>   2893          struct io_ring_ctx *ctx = req->ctx;
>   2894          struct io_async_ctx *io;
>   2895          int ret;
>   2896  
>   2897          /* Still need defer if there is pending req in defer list. */
>   2898          if (!req_need_defer(req) && list_empty(&ctx->defer_list))
>   2899                  return 0;
>   2900  
>   2901          io = kmalloc(sizeof(*io), GFP_KERNEL);
>   2902          if (!io)
>   2903                  return -EAGAIN;
>   2904  
>   2905          spin_lock_irq(&ctx->completion_lock);
>   2906          if (!req_need_defer(req) && list_empty(&ctx->defer_list)) {
>   2907                  spin_unlock_irq(&ctx->completion_lock);
>   2908                  kfree(io);
>   2909                  return 0;
>   2910          }
>   2911  
>   2912          ret = io_req_defer_prep(req, io);
>   2913          if (ret < 0)
>   2914                  return ret;
> 
> We need to spin_unlock_irq(&ctx->completion_lock); before returning.
> The question of if we need to kfree(io) is more complicated to me
> because I'm not sure how kiocb->ki_complete gets called...
> 
>   2915  
>   2916          trace_io_uring_defer(ctx, req, req->user_data);
>   2917          list_add_tail(&req->list, &ctx->defer_list);
>   2918          spin_unlock_irq(&ctx->completion_lock);
>   2919          return -EIOCBQUEUED;
>   2920  }
> 
> regards,
> dan carpenter