io-uring.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH] io_uring: don't free request to slab
@ 2021-08-25 11:40 Hao Xu
  2021-08-25 13:28 ` Pavel Begunkov
  0 siblings, 1 reply; 4+ messages in thread
From: Hao Xu @ 2021-08-25 11:40 UTC (permalink / raw)
  To: Jens Axboe; +Cc: io-uring, Pavel Begunkov, Joseph Qi

It's not neccessary to free the request back to slab when we fail to
get sqe, just update state->free_reqs pointer.

Signed-off-by: Hao Xu <haoxu@linux.alibaba.com>
---
 fs/io_uring.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 74b606990d7e..ce66a9ce2b43 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -6899,7 +6899,7 @@ static int io_submit_sqes(struct io_ring_ctx *ctx, unsigned int nr)
 		}
 		sqe = io_get_sqe(ctx);
 		if (unlikely(!sqe)) {
-			kmem_cache_free(req_cachep, req);
+			ctx->submit_state.free_reqs++;
 			break;
 		}
 		/* will complete beyond this point, count as submitted */
-- 
2.24.4


^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: [PATCH] io_uring: don't free request to slab
  2021-08-25 11:40 [PATCH] io_uring: don't free request to slab Hao Xu
@ 2021-08-25 13:28 ` Pavel Begunkov
  2021-08-25 15:38   ` Hao Xu
  0 siblings, 1 reply; 4+ messages in thread
From: Pavel Begunkov @ 2021-08-25 13:28 UTC (permalink / raw)
  To: Hao Xu, Jens Axboe; +Cc: io-uring, Joseph Qi

On 8/25/21 12:40 PM, Hao Xu wrote:
> It's not neccessary to free the request back to slab when we fail to
> get sqe, just update state->free_reqs pointer.

It's a bit hackish because depends on the request being drawn
from the array in a particular way. How about returning it
into state->free_list. That thing is as cold as it can get,
only buggy apps can hit it. 


> Signed-off-by: Hao Xu <haoxu@linux.alibaba.com>
> ---
>  fs/io_uring.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/fs/io_uring.c b/fs/io_uring.c
> index 74b606990d7e..ce66a9ce2b43 100644
> --- a/fs/io_uring.c
> +++ b/fs/io_uring.c
> @@ -6899,7 +6899,7 @@ static int io_submit_sqes(struct io_ring_ctx *ctx, unsigned int nr)
>  		}
>  		sqe = io_get_sqe(ctx);
>  		if (unlikely(!sqe)) {
> -			kmem_cache_free(req_cachep, req);
> +			ctx->submit_state.free_reqs++;
>  			break;
>  		}
>  		/* will complete beyond this point, count as submitted */
> 

-- 
Pavel Begunkov

^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: [PATCH] io_uring: don't free request to slab
  2021-08-25 13:28 ` Pavel Begunkov
@ 2021-08-25 15:38   ` Hao Xu
  2021-08-25 16:02     ` Pavel Begunkov
  0 siblings, 1 reply; 4+ messages in thread
From: Hao Xu @ 2021-08-25 15:38 UTC (permalink / raw)
  To: Pavel Begunkov, Jens Axboe; +Cc: io-uring, Joseph Qi

在 2021/8/25 下午9:28, Pavel Begunkov 写道:
> On 8/25/21 12:40 PM, Hao Xu wrote:
>> It's not neccessary to free the request back to slab when we fail to
>> get sqe, just update state->free_reqs pointer.
> 
> It's a bit hackish because depends on the request being drawn
> from the array in a particular way. How about returning it
It seems a req is always allocated from state->reqs, so it should be
ok? I actually didn't understand 'hackish' here, do you mean
io_submit_sqes() shouldn't move state->free_reqs which is req caches'
internal implementation?
> into state->free_list. That thing is as cold as it can get,
> only buggy apps can hit it.
> 

^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: [PATCH] io_uring: don't free request to slab
  2021-08-25 15:38   ` Hao Xu
@ 2021-08-25 16:02     ` Pavel Begunkov
  0 siblings, 0 replies; 4+ messages in thread
From: Pavel Begunkov @ 2021-08-25 16:02 UTC (permalink / raw)
  To: Hao Xu, Jens Axboe; +Cc: io-uring, Joseph Qi

On 8/25/21 4:38 PM, Hao Xu wrote:
> 在 2021/8/25 下午9:28, Pavel Begunkov 写道:
>> On 8/25/21 12:40 PM, Hao Xu wrote:
>>> It's not neccessary to free the request back to slab when we fail to
>>> get sqe, just update state->free_reqs pointer.
>>
>> It's a bit hackish because depends on the request being drawn
>> from the array in a particular way. How about returning it
> It seems a req is always allocated from state->reqs, so it should be
> ok? I actually didn't understand 'hackish' here, do you mean
> io_submit_sqes() shouldn't move state->free_reqs which is req caches'
> internal implementation?

I mean it uses implicit knowledge of how io_alloc_req() works, which
may and actually will change. It's just always too easy to forget
about that little one-off thing while changing another chunk.

To give an example, if one decides to remake it and first serve
requests from state->free_list and only when it's empty look into
state->reqs, it's too easy to forget opening a pretty severe
vulnerability.

If there is not much profit from it comparing to the risks, I'd
personally prefer to go with a safer way.  


>> into state->free_list. That thing is as cold as it can get,
>> only buggy apps can hit it.
>>

-- 
Pavel Begunkov

^ permalink raw reply	[flat|nested] 4+ messages in thread

end of thread, other threads:[~2021-08-25 16:03 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-08-25 11:40 [PATCH] io_uring: don't free request to slab Hao Xu
2021-08-25 13:28 ` Pavel Begunkov
2021-08-25 15:38   ` Hao Xu
2021-08-25 16:02     ` Pavel Begunkov

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).