io_uring / POLLFREE bug

io_uring / POLLFREE bug

[Alexandre]

Hello,

I wanted (as an exercise) to dive into recent io_uring / POLLFREE pb and try to understand what really happens under the hood. I looked at this commit of yours : https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit?h=linux-5.4.y&id=fc78b2fc21f10c4c9c4d5d659a685710ffa63659 and tried to investigate from there. Basically, I tried to produce the bug / trigger a crash with a small C code (using liburing) that creates a signalfd() and polls it with io_uring. I failed until now to understand what happens.

This is my understanding of the situation :
- "signalfd_wqh" is a queue created during task creation (kernel/fork.c:sighand_ctor())
- it is freed with kmem_cache_free() at task end (kernel/fork.c/__cleanup_sighand())
- before it is freed, there is a call to signalfd_cleanup() that sends a POLLFREE (kernel/fork.c/__cleanup_sighand())
- waiters are supposed to use this POLLFREE to stop polling and free resources, but io_uring does not do that 
- the bug is that : io_uring_poll (io_uring.c) calls signalfd_poll() using signalfd_wqh as its poll_table parameter, but it has been freed (poll_wait, should crash I suppose)
- since the task must be finished, we *MUST* use "kernel polled" mode, to allow kernel to continue polling after the memory was freed. Otherwise we can't trigger the bug, can we ?
- but then, why would kernel enter io_uring_poll after task was terminated ?

Thanks again and keep up the good work