Re: [PATCH] io_uring/io-wq: Fix a small time window for reading work->flags

[Pavel Begunkov <asml.silence@gmail.com>]

On 1/15/25 01:50, lizetao wrote:
> Hi,
> 
>> -----Original Message-----
>> From: Pavel Begunkov <asml.silence@gmail.com>
>> Sent: Wednesday, January 15, 2025 12:22 AM
>> To: lizetao <lizetao1@huawei.com>; Jens Axboe <axboe@kernel.dk>
>> Cc: io-uring@vger.kernel.org
>> Subject: Re: [PATCH] io_uring/io-wq: Fix a small time window for reading work-
>>> flags
>>
>> On 1/14/25 02:06, lizetao wrote:
>>> There is a small time window that is modified by other tasks after
>>> reading work->flags. It is changed to read before use, which is more
>>
>> Can you elaborate on what races with what? I don't immediately see any race
>> here.
> 
> There is such a race context:
> 	
> 	worker												process
> io_worker_handle_work:										IORING_OP_ASYNC_CANCEL
> 	io_wq_enqueue										__io_wq_worker_cancel
> 		work_flags = atomic_read(&work->flags);	// no IO_WQ_WORK_CANCEL		
> 													atomic_or(IO_WQ_WORK_CANCEL, &work->flags);

													^^^

That can't happen, the request is not discoverable via iowq yet.

> 		if (work_flags & IO_WQ_WORK_CANCEL)	// false

This check is for requests that came with the flag already set.

-- 
Pavel Begunkov