[PATCH] io_uring: don't free request to slab

[PATCH] io_uring: don't free request to slab

[Hao Xu]

It's not neccessary to free the request back to slab when we fail to
get sqe, just update state->free_reqs pointer.

Signed-off-by: Hao Xu <haoxu@linux.alibaba.com>
---
 fs/io_uring.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 74b606990d7e..ce66a9ce2b43 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -6899,7 +6899,7 @@ static int io_submit_sqes(struct io_ring_ctx *ctx, unsigned int nr)
 		}
 		sqe = io_get_sqe(ctx);
 		if (unlikely(!sqe)) {
-			kmem_cache_free(req_cachep, req);
+			ctx->submit_state.free_reqs++;
 			break;
 		}
 		/* will complete beyond this point, count as submitted */
-- 
2.24.4

Re: [PATCH] io_uring: don't free request to slab

[Pavel Begunkov]

On 8/25/21 12:40 PM, Hao Xu wrote:
> It's not neccessary to free the request back to slab when we fail to
> get sqe, just update state->free_reqs pointer.

It's a bit hackish because depends on the request being drawn
from the array in a particular way. How about returning it
into state->free_list. That thing is as cold as it can get,
only buggy apps can hit it. 


> Signed-off-by: Hao Xu <haoxu@linux.alibaba.com>
> ---
>  fs/io_uring.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/fs/io_uring.c b/fs/io_uring.c
> index 74b606990d7e..ce66a9ce2b43 100644
> --- a/fs/io_uring.c
> +++ b/fs/io_uring.c
> @@ -6899,7 +6899,7 @@ static int io_submit_sqes(struct io_ring_ctx *ctx, unsigned int nr)
>  		}
>  		sqe = io_get_sqe(ctx);
>  		if (unlikely(!sqe)) {
> -			kmem_cache_free(req_cachep, req);
> +			ctx->submit_state.free_reqs++;
>  			break;
>  		}
>  		/* will complete beyond this point, count as submitted */
> 

-- 
Pavel Begunkov

Re: [PATCH] io_uring: don't free request to slab

[Hao Xu]

在 2021/8/25 下午9:28, Pavel Begunkov 写道:
> On 8/25/21 12:40 PM, Hao Xu wrote:
>> It's not neccessary to free the request back to slab when we fail to
>> get sqe, just update state->free_reqs pointer.
> 
> It's a bit hackish because depends on the request being drawn
> from the array in a particular way. How about returning it
It seems a req is always allocated from state->reqs, so it should be
ok? I actually didn't understand 'hackish' here, do you mean
io_submit_sqes() shouldn't move state->free_reqs which is req caches'
internal implementation?
> into state->free_list. That thing is as cold as it can get,
> only buggy apps can hit it.
> 

Re: [PATCH] io_uring: don't free request to slab

[Pavel Begunkov]

On 8/25/21 4:38 PM, Hao Xu wrote:
> 在 2021/8/25 下午9:28, Pavel Begunkov 写道:
>> On 8/25/21 12:40 PM, Hao Xu wrote:
>>> It's not neccessary to free the request back to slab when we fail to
>>> get sqe, just update state->free_reqs pointer.
>>
>> It's a bit hackish because depends on the request being drawn
>> from the array in a particular way. How about returning it
> It seems a req is always allocated from state->reqs, so it should be
> ok? I actually didn't understand 'hackish' here, do you mean
> io_submit_sqes() shouldn't move state->free_reqs which is req caches'
> internal implementation?

I mean it uses implicit knowledge of how io_alloc_req() works, which
may and actually will change. It's just always too easy to forget
about that little one-off thing while changing another chunk.

To give an example, if one decides to remake it and first serve
requests from state->free_list and only when it's empty look into
state->reqs, it's too easy to forget opening a pretty severe
vulnerability.

If there is not much profit from it comparing to the risks, I'd
personally prefer to go with a safer way.  


>> into state->free_list. That thing is as cold as it can get,
>> only buggy apps can hit it.
>>

-- 
Pavel Begunkov