From: Pavel Begunkov <asml.silence@gmail.com>
To: Jens Axboe <axboe@kernel.dk>, io-uring@vger.kernel.org
Cc: Hao Xu <haoxu@linux.alibaba.com>,
syzbot+f9704d1878e290eddf73@syzkaller.appspotmail.com
Subject: [PATCH v2 1/2] io_uring: fix queueing half-created requests
Date: Tue, 31 Aug 2021 14:13:10 +0100 [thread overview]
Message-ID: <70b513848c1000f88bd75965504649c6bb1415c0.1630415423.git.asml.silence@gmail.com> (raw)
In-Reply-To: <cover.1630415423.git.asml.silence@gmail.com>
[ 27.259845] general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] SMP KASAN PTI
[ 27.261043] KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
[ 27.263730] RIP: 0010:sock_from_file+0x20/0x90
[ 27.272444] Call Trace:
[ 27.272736] io_sendmsg+0x98/0x600
[ 27.279216] io_issue_sqe+0x498/0x68d0
[ 27.281142] __io_queue_sqe+0xab/0xb50
[ 27.285830] io_req_task_submit+0xbf/0x1b0
[ 27.286306] tctx_task_work+0x178/0xad0
[ 27.288211] task_work_run+0xe2/0x190
[ 27.288571] exit_to_user_mode_prepare+0x1a1/0x1b0
[ 27.289041] syscall_exit_to_user_mode+0x19/0x50
[ 27.289521] do_syscall_64+0x48/0x90
[ 27.289871] entry_SYSCALL_64_after_hwframe+0x44/0xae
io_req_complete_failed() -> io_req_complete_post() ->
io_req_task_queue() still would try to enqueue hard linked request,
which can be half prepared (e.g. failed init), so we can't allow
that to happen.
Fixes: a8295b982c46d ("io_uring: fix failed linkchain code logic")
Reported-by: syzbot+f9704d1878e290eddf73@syzkaller.appspotmail.com
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
---
fs/io_uring.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/fs/io_uring.c b/fs/io_uring.c
index 473a977c7979..6e07456d9842 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -1823,6 +1823,17 @@ static void io_req_complete_failed(struct io_kiocb *req, long res)
io_req_complete_post(req, res, 0);
}
+static void io_req_complete_fail_submit(struct io_kiocb *req)
+{
+ /*
+ * We don't submit, fail them all, for that replace hardlinks with
+ * normal links. Extra REQ_F_LINK is tolerated.
+ */
+ req->flags &= ~REQ_F_HARDLINK;
+ req->flags |= REQ_F_LINK;
+ io_req_complete_failed(req, req->result);
+}
+
/*
* Don't initialise the fields below on every allocation, but do that in
* advance and keep them valid across allocations.
@@ -6717,7 +6728,7 @@ static inline void io_queue_sqe(struct io_kiocb *req)
if (likely(!(req->flags & (REQ_F_FORCE_ASYNC | REQ_F_FAIL)))) {
__io_queue_sqe(req);
} else if (req->flags & REQ_F_FAIL) {
- io_req_complete_failed(req, req->result);
+ io_req_complete_fail_submit(req);
} else {
int ret = io_req_prep_async(req);
--
2.33.0
next prev parent reply other threads:[~2021-08-31 13:13 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-08-31 13:13 [PATCH v2 0/2] fix failing request submission Pavel Begunkov
2021-08-31 13:13 ` Pavel Begunkov [this message]
2021-08-31 13:13 ` [PATCH v2 2/2] io_uring: don't submit half-prepared drain request Pavel Begunkov
2021-08-31 16:57 ` [PATCH v2 0/2] fix failing request submission Jens Axboe
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=70b513848c1000f88bd75965504649c6bb1415c0.1630415423.git.asml.silence@gmail.com \
--to=asml.silence@gmail.com \
--cc=axboe@kernel.dk \
--cc=haoxu@linux.alibaba.com \
--cc=io-uring@vger.kernel.org \
--cc=syzbot+f9704d1878e290eddf73@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).