stable.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* FAILED: patch "[PATCH] io_uring: always prep_async for drain requests" failed to apply to 6.1-stable tree
@ 2023-01-29 13:26 gregkh
  2023-01-29 19:40 ` Jens Axboe
  0 siblings, 1 reply; 4+ messages in thread
From: gregkh @ 2023-01-29 13:26 UTC (permalink / raw)
  To: dylany, axboe; +Cc: stable


The patch below does not apply to the 6.1-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.

Possible dependencies:

ef5c600adb1d ("io_uring: always prep_async for drain requests")
973fc83f3a94 ("io_uring: defer all io_req_complete_failed")
1bec951c3809 ("io_uring: iopoll protect complete_post")
fa18fa2272c7 ("io_uring: inline __io_req_complete_put()")
e276ae344a77 ("io_uring: hold locks for io_req_complete_failed")
f9d567c75ec2 ("io_uring: inline __io_req_complete_post()")

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From ef5c600adb1d985513d2b612cc90403a148ff287 Mon Sep 17 00:00:00 2001
From: Dylan Yudaken <dylany@meta.com>
Date: Fri, 27 Jan 2023 02:59:11 -0800
Subject: [PATCH] io_uring: always prep_async for drain requests

Drain requests all go through io_drain_req, which has a quick exit in case
there is nothing pending (ie the drain is not useful). In that case it can
run the issue the request immediately.

However for safety it queues it through task work.
The problem is that in this case the request is run asynchronously, but
the async work has not been prepared through io_req_prep_async.

This has not been a problem up to now, as the task work always would run
before returning to userspace, and so the user would not have a chance to
race with it.

However - with IORING_SETUP_DEFER_TASKRUN - this is no longer the case and
the work might be defered, giving userspace a chance to change data being
referred to in the request.

Instead _always_ prep_async for drain requests, which is simpler anyway
and removes this issue.

Cc: stable@vger.kernel.org
Fixes: c0e0d6ba25f1 ("io_uring: add IORING_SETUP_DEFER_TASKRUN")
Signed-off-by: Dylan Yudaken <dylany@meta.com>
Link: https://lore.kernel.org/r/20230127105911.2420061-1-dylany@meta.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index 0a4efada9b3c..db623b3185c8 100644
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -1765,17 +1765,12 @@ static __cold void io_drain_req(struct io_kiocb *req)
 	}
 	spin_unlock(&ctx->completion_lock);
 
-	ret = io_req_prep_async(req);
-	if (ret) {
-fail:
-		io_req_defer_failed(req, ret);
-		return;
-	}
 	io_prep_async_link(req);
 	de = kmalloc(sizeof(*de), GFP_KERNEL);
 	if (!de) {
 		ret = -ENOMEM;
-		goto fail;
+		io_req_defer_failed(req, ret);
+		return;
 	}
 
 	spin_lock(&ctx->completion_lock);
@@ -2048,13 +2043,16 @@ static void io_queue_sqe_fallback(struct io_kiocb *req)
 		req->flags &= ~REQ_F_HARDLINK;
 		req->flags |= REQ_F_LINK;
 		io_req_defer_failed(req, req->cqe.res);
-	} else if (unlikely(req->ctx->drain_active)) {
-		io_drain_req(req);
 	} else {
 		int ret = io_req_prep_async(req);
 
-		if (unlikely(ret))
+		if (unlikely(ret)) {
 			io_req_defer_failed(req, ret);
+			return;
+		}
+
+		if (unlikely(req->ctx->drain_active))
+			io_drain_req(req);
 		else
 			io_queue_iowq(req, NULL);
 	}


^ permalink raw reply related	[flat|nested] 4+ messages in thread

* Re: FAILED: patch "[PATCH] io_uring: always prep_async for drain requests" failed to apply to 6.1-stable tree
  2023-01-29 13:26 FAILED: patch "[PATCH] io_uring: always prep_async for drain requests" failed to apply to 6.1-stable tree gregkh
@ 2023-01-29 19:40 ` Jens Axboe
  2023-01-30 10:04   ` Greg KH
  0 siblings, 1 reply; 4+ messages in thread
From: Jens Axboe @ 2023-01-29 19:40 UTC (permalink / raw)
  To: gregkh, dylany; +Cc: stable

[-- Attachment #1: Type: text/plain, Size: 333 bytes --]

On 1/29/23 6:26 AM, gregkh@linuxfoundation.org wrote:
> 
> The patch below does not apply to the 6.1-stable tree.
> If someone wants it applied there, or to any other stable or longterm
> tree, then please email the backport, including the original git commit
> id to <stable@vger.kernel.org>.

This should do it.

-- 
Jens Axboe


[-- Attachment #2: 0001-io_uring-always-prep_async-for-drain-requests.patch --]
[-- Type: text/x-patch, Size: 2549 bytes --]

From 71a58ab8cf1bb4b4c286fbabe266a82bab20fdf2 Mon Sep 17 00:00:00 2001
From: Dylan Yudaken <dylany@meta.com>
Date: Sun, 29 Jan 2023 12:34:51 -0700
Subject: [PATCH] io_uring: always prep_async for drain requests

commit ef5c600adb1d985513d2b612cc90403a148ff287 upstream.

Drain requests all go through io_drain_req, which has a quick exit in case
there is nothing pending (ie the drain is not useful). In that case it can
run the issue the request immediately.

However for safety it queues it through task work.
The problem is that in this case the request is run asynchronously, but
the async work has not been prepared through io_req_prep_async.

This has not been a problem up to now, as the task work always would run
before returning to userspace, and so the user would not have a chance to
race with it.

However - with IORING_SETUP_DEFER_TASKRUN - this is no longer the case and
the work might be defered, giving userspace a chance to change data being
referred to in the request.

Instead _always_ prep_async for drain requests, which is simpler anyway
and removes this issue.

Cc: stable@vger.kernel.org
Fixes: c0e0d6ba25f1 ("io_uring: add IORING_SETUP_DEFER_TASKRUN")
Signed-off-by: Dylan Yudaken <dylany@meta.com>
Link: https://lore.kernel.org/r/20230127105911.2420061-1-dylany@meta.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
---
 io_uring/io_uring.c | 18 ++++++++----------
 1 file changed, 8 insertions(+), 10 deletions(-)

diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index cea5de98c423..6fc4aaef5fe2 100644
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -1658,17 +1658,12 @@ static __cold void io_drain_req(struct io_kiocb *req)
 	}
 	spin_unlock(&ctx->completion_lock);
 
-	ret = io_req_prep_async(req);
-	if (ret) {
-fail:
-		io_req_complete_failed(req, ret);
-		return;
-	}
 	io_prep_async_link(req);
 	de = kmalloc(sizeof(*de), GFP_KERNEL);
 	if (!de) {
 		ret = -ENOMEM;
-		goto fail;
+		io_req_complete_failed(req, ret);
+		return;
 	}
 
 	spin_lock(&ctx->completion_lock);
@@ -1942,13 +1937,16 @@ static void io_queue_sqe_fallback(struct io_kiocb *req)
 		req->flags &= ~REQ_F_HARDLINK;
 		req->flags |= REQ_F_LINK;
 		io_req_complete_failed(req, req->cqe.res);
-	} else if (unlikely(req->ctx->drain_active)) {
-		io_drain_req(req);
 	} else {
 		int ret = io_req_prep_async(req);
 
-		if (unlikely(ret))
+		if (unlikely(ret)) {
 			io_req_complete_failed(req, ret);
+			return;
+		}
+
+		if (unlikely(req->ctx->drain_active))
+			io_drain_req(req);
 		else
 			io_queue_iowq(req, NULL);
 	}
-- 
2.39.0


^ permalink raw reply related	[flat|nested] 4+ messages in thread

* Re: FAILED: patch "[PATCH] io_uring: always prep_async for drain requests" failed to apply to 6.1-stable tree
  2023-01-29 19:40 ` Jens Axboe
@ 2023-01-30 10:04   ` Greg KH
  2023-01-30 15:05     ` Jens Axboe
  0 siblings, 1 reply; 4+ messages in thread
From: Greg KH @ 2023-01-30 10:04 UTC (permalink / raw)
  To: Jens Axboe; +Cc: dylany, stable

On Sun, Jan 29, 2023 at 12:40:11PM -0700, Jens Axboe wrote:
> On 1/29/23 6:26 AM, gregkh@linuxfoundation.org wrote:
> > 
> > The patch below does not apply to the 6.1-stable tree.
> > If someone wants it applied there, or to any other stable or longterm
> > tree, then please email the backport, including the original git commit
> > id to <stable@vger.kernel.org>.
> 
> This should do it.

Looks like Sasha beat me to it :)

thanks for the backport!

greg k-h

^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: FAILED: patch "[PATCH] io_uring: always prep_async for drain requests" failed to apply to 6.1-stable tree
  2023-01-30 10:04   ` Greg KH
@ 2023-01-30 15:05     ` Jens Axboe
  0 siblings, 0 replies; 4+ messages in thread
From: Jens Axboe @ 2023-01-30 15:05 UTC (permalink / raw)
  To: Greg KH; +Cc: dylany, stable

On 1/30/23 3:04 AM, Greg KH wrote:
> On Sun, Jan 29, 2023 at 12:40:11PM -0700, Jens Axboe wrote:
>> On 1/29/23 6:26 AM, gregkh@linuxfoundation.org wrote:
>>>
>>> The patch below does not apply to the 6.1-stable tree.
>>> If someone wants it applied there, or to any other stable or longterm
>>> tree, then please email the backport, including the original git commit
>>> id to <stable@vger.kernel.org>.
>>
>> This should do it.
> 
> Looks like Sasha beat me to it :)
> 
> thanks for the backport!

Yep, looks like Sasha just pulled in the dependencies, which is
fine with me too.

-- 
Jens Axboe



^ permalink raw reply	[flat|nested] 4+ messages in thread

end of thread, other threads:[~2023-01-30 15:05 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-01-29 13:26 FAILED: patch "[PATCH] io_uring: always prep_async for drain requests" failed to apply to 6.1-stable tree gregkh
2023-01-29 19:40 ` Jens Axboe
2023-01-30 10:04   ` Greg KH
2023-01-30 15:05     ` Jens Axboe

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).