* [PATCH 1/1] io_uring: annotate offset timeout races
@ 2023-05-19 14:21 Pavel Begunkov
2023-05-20 1:57 ` Jens Axboe
0 siblings, 1 reply; 2+ messages in thread
From: Pavel Begunkov @ 2023-05-19 14:21 UTC (permalink / raw)
To: io-uring; +Cc: Jens Axboe, asml.silence, syzbot+cb265db2f3f3468ef436
It's racy to read ->cached_cq_tail without taking proper measures
(usually grabbing ->completion_lock) as timeout requests with CQE
offsets do, however they have never had a good semantics for from
when they start counting. Annotate racy reads with data_race().
Reported-by: [email protected]
Signed-off-by: Pavel Begunkov <[email protected]>
---
io_uring/timeout.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/io_uring/timeout.c b/io_uring/timeout.c
index fc950177e2e1..350eb830b485 100644
--- a/io_uring/timeout.c
+++ b/io_uring/timeout.c
@@ -594,7 +594,7 @@ int io_timeout(struct io_kiocb *req, unsigned int issue_flags)
goto add;
}
- tail = ctx->cached_cq_tail - atomic_read(&ctx->cq_timeouts);
+ tail = data_race(ctx->cached_cq_tail) - atomic_read(&ctx->cq_timeouts);
timeout->target_seq = tail + off;
/* Update the last seq here in case io_flush_timeouts() hasn't.
--
2.40.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH 1/1] io_uring: annotate offset timeout races
2023-05-19 14:21 [PATCH 1/1] io_uring: annotate offset timeout races Pavel Begunkov
@ 2023-05-20 1:57 ` Jens Axboe
0 siblings, 0 replies; 2+ messages in thread
From: Jens Axboe @ 2023-05-20 1:57 UTC (permalink / raw)
To: io-uring, Pavel Begunkov; +Cc: syzbot+cb265db2f3f3468ef436
On Fri, 19 May 2023 15:21:16 +0100, Pavel Begunkov wrote:
> It's racy to read ->cached_cq_tail without taking proper measures
> (usually grabbing ->completion_lock) as timeout requests with CQE
> offsets do, however they have never had a good semantics for from
> when they start counting. Annotate racy reads with data_race().
>
>
Applied, thanks!
[1/1] io_uring: annotate offset timeout races
commit: 5498bf28d8f2bd63a46ad40f4427518615fb793f
Best regards,
--
Jens Axboe
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2023-05-20 1:57 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-05-19 14:21 [PATCH 1/1] io_uring: annotate offset timeout races Pavel Begunkov
2023-05-20 1:57 ` Jens Axboe
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox