* [PATCH for-current 0/2] sqo files/mm fixes
@ 2021-01-11 4:00 Pavel Begunkov
2021-01-11 4:00 ` [PATCH 1/2] io_uring: drop mm and files after task_work_run Pavel Begunkov
` (2 more replies)
0 siblings, 3 replies; 6+ messages in thread
From: Pavel Begunkov @ 2021-01-11 4:00 UTC (permalink / raw)
To: Jens Axboe, io-uring
Neither of issues is confirmed, but should be a good hardening in any
case. Inefficiencies will be removed for-next.
Pavel Begunkov (2):
io_uring: drop mm and files after task_work_run
io_uring: don't take files/mm for a dead task
fs/io_uring.c | 7 +++++++
1 file changed, 7 insertions(+)
--
2.24.0
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH 1/2] io_uring: drop mm and files after task_work_run
2021-01-11 4:00 [PATCH for-current 0/2] sqo files/mm fixes Pavel Begunkov
@ 2021-01-11 4:00 ` Pavel Begunkov
2021-01-11 4:00 ` [PATCH 2/2] io_uring: don't take files/mm for a dead task Pavel Begunkov
2021-01-14 21:12 ` [PATCH for-current 0/2] sqo files/mm fixes Pavel Begunkov
2 siblings, 0 replies; 6+ messages in thread
From: Pavel Begunkov @ 2021-01-11 4:00 UTC (permalink / raw)
To: Jens Axboe, io-uring; +Cc: stable
__io_req_task_submit() run by task_work can set mm and files, but
io_sq_thread() in some cases, and because __io_sq_thread_acquire_mm()
and __io_sq_thread_acquire_files() do a simple current->mm/files check
it may end up submitting IO with mm/files of another task.
We also need to drop it after in the end to drop potentially grabbed
references to them.
Cc: [email protected] # 5.9+
Signed-off-by: Pavel Begunkov <[email protected]>
---
fs/io_uring.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/io_uring.c b/fs/io_uring.c
index 2f305c097bd5..7af74c1ec909 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -7056,6 +7056,7 @@ static int io_sq_thread(void *data)
if (sqt_spin || !time_after(jiffies, timeout)) {
io_run_task_work();
+ io_sq_thread_drop_mm_files();
cond_resched();
if (sqt_spin)
timeout = jiffies + sqd->sq_thread_idle;
@@ -7093,6 +7094,7 @@ static int io_sq_thread(void *data)
}
io_run_task_work();
+ io_sq_thread_drop_mm_files();
if (cur_css)
io_sq_thread_unassociate_blkcg();
--
2.24.0
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH 2/2] io_uring: don't take files/mm for a dead task
2021-01-11 4:00 [PATCH for-current 0/2] sqo files/mm fixes Pavel Begunkov
2021-01-11 4:00 ` [PATCH 1/2] io_uring: drop mm and files after task_work_run Pavel Begunkov
@ 2021-01-11 4:00 ` Pavel Begunkov
2021-01-14 21:12 ` [PATCH for-current 0/2] sqo files/mm fixes Pavel Begunkov
2 siblings, 0 replies; 6+ messages in thread
From: Pavel Begunkov @ 2021-01-11 4:00 UTC (permalink / raw)
To: Jens Axboe, io-uring; +Cc: stable
In rare cases a task may be exiting while io_ring_exit_work() trying to
cancel/wait its requests. It's ok for __io_sq_thread_acquire_mm()
because of SQPOLL check, but is not for __io_sq_thread_acquire_files().
Play safe and fail for both of them.
Cc: [email protected] # 5.5+
Signed-off-by: Pavel Begunkov <[email protected]>
---
fs/io_uring.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/fs/io_uring.c b/fs/io_uring.c
index 7af74c1ec909..b0e6d8e607a3 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -1106,6 +1106,9 @@ static void io_sq_thread_drop_mm_files(void)
static int __io_sq_thread_acquire_files(struct io_ring_ctx *ctx)
{
+ if (current->flags & PF_EXITING)
+ return -EFAULT;
+
if (!current->files) {
struct files_struct *files;
struct nsproxy *nsproxy;
@@ -1133,6 +1136,8 @@ static int __io_sq_thread_acquire_mm(struct io_ring_ctx *ctx)
{
struct mm_struct *mm;
+ if (current->flags & PF_EXITING)
+ return -EFAULT;
if (current->mm)
return 0;
--
2.24.0
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH for-current 0/2] sqo files/mm fixes
2021-01-11 4:00 [PATCH for-current 0/2] sqo files/mm fixes Pavel Begunkov
2021-01-11 4:00 ` [PATCH 1/2] io_uring: drop mm and files after task_work_run Pavel Begunkov
2021-01-11 4:00 ` [PATCH 2/2] io_uring: don't take files/mm for a dead task Pavel Begunkov
@ 2021-01-14 21:12 ` Pavel Begunkov
2021-01-14 23:28 ` Jens Axboe
2 siblings, 1 reply; 6+ messages in thread
From: Pavel Begunkov @ 2021-01-14 21:12 UTC (permalink / raw)
To: Jens Axboe, io-uring
On 11/01/2021 04:00, Pavel Begunkov wrote:
> Neither of issues is confirmed, but should be a good hardening in any
> case. Inefficiencies will be removed for-next.
A reminder just in case it was lost
>
> Pavel Begunkov (2):
> io_uring: drop mm and files after task_work_run
> io_uring: don't take files/mm for a dead task
>
> fs/io_uring.c | 7 +++++++
> 1 file changed, 7 insertions(+)
>
--
Pavel Begunkov
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH for-current 0/2] sqo files/mm fixes
2021-01-14 21:12 ` [PATCH for-current 0/2] sqo files/mm fixes Pavel Begunkov
@ 2021-01-14 23:28 ` Jens Axboe
2021-01-15 12:33 ` Pavel Begunkov
0 siblings, 1 reply; 6+ messages in thread
From: Jens Axboe @ 2021-01-14 23:28 UTC (permalink / raw)
To: Pavel Begunkov, io-uring
On 1/14/21 2:12 PM, Pavel Begunkov wrote:
> On 11/01/2021 04:00, Pavel Begunkov wrote:
>> Neither of issues is confirmed, but should be a good hardening in any
>> case. Inefficiencies will be removed for-next.
>
> A reminder just in case it was lost
Maybe I forgot to send out a reply, but they are in the io_uring-5.11
branch.
--
Jens Axboe
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH for-current 0/2] sqo files/mm fixes
2021-01-14 23:28 ` Jens Axboe
@ 2021-01-15 12:33 ` Pavel Begunkov
0 siblings, 0 replies; 6+ messages in thread
From: Pavel Begunkov @ 2021-01-15 12:33 UTC (permalink / raw)
To: Jens Axboe, io-uring
On 14/01/2021 23:28, Jens Axboe wrote:
> On 1/14/21 2:12 PM, Pavel Begunkov wrote:
>> On 11/01/2021 04:00, Pavel Begunkov wrote:
>>> Neither of issues is confirmed, but should be a good hardening in any
>>> case. Inefficiencies will be removed for-next.
>>
>> A reminder just in case it was lost
>
> Maybe I forgot to send out a reply, but they are in the io_uring-5.11
> branch.
Missed it in the tree. Thanks!
--
Pavel Begunkov
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2021-01-15 12:47 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2021-01-11 4:00 [PATCH for-current 0/2] sqo files/mm fixes Pavel Begunkov
2021-01-11 4:00 ` [PATCH 1/2] io_uring: drop mm and files after task_work_run Pavel Begunkov
2021-01-11 4:00 ` [PATCH 2/2] io_uring: don't take files/mm for a dead task Pavel Begunkov
2021-01-14 21:12 ` [PATCH for-current 0/2] sqo files/mm fixes Pavel Begunkov
2021-01-14 23:28 ` Jens Axboe
2021-01-15 12:33 ` Pavel Begunkov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox