public inbox for [email protected]
 help / color / mirror / Atom feed
* [PATCH] io_uring: Fix WARNING in io_cqring_event_overflow
@ 2024-07-03  0:48 Pei Li
  2024-07-03 12:07 ` Jens Axboe
  0 siblings, 1 reply; 2+ messages in thread
From: Pei Li @ 2024-07-03  0:48 UTC (permalink / raw)
  To: Jens Axboe, Pavel Begunkov
  Cc: io-uring, linux-kernel, skhan, syzkaller-bugs,
	linux-kernel-mentees, syzbot+f7f9c893345c5c615d34, Pei Li

Acquire ctx->completion_lock in io_add_aux_cqe().

syzbot reports a warning message in io_cqring_event_overflow(). We were
supposed to hold ctx->completion_lock before entering this function, but
instead we did not.

This patch acquires and releases ctx->completion_lock when entering and
exiting io_add_aux_cqe().

Fixes: f33096a3c99c ("io_uring: add io_add_aux_cqe() helper")
Reported-by: [email protected]
Closes: https://syzkaller.appspot.com/bug?extid=f7f9c893345c5c615d34
Signed-off-by: Pei Li <[email protected]>
---
syzbot reports a warning message in io_cqring_event_overflow(). We were
supposed to hold ctx->completion_lock before entering this function, but
instead we did not.

The call stack is as follows:

Call Trace:
 <TASK>
 __io_post_aux_cqe io_uring/io_uring.c:816 [inline]
 io_add_aux_cqe+0x27c/0x320 io_uring/io_uring.c:837
 io_msg_tw_complete+0x9d/0x4d0 io_uring/msg_ring.c:78
 io_fallback_req_func+0xce/0x1c0 io_uring/io_uring.c:256
 process_one_work kernel/workqueue.c:3224 [inline]
 process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3305
 worker_thread+0x86d/0xd40 kernel/workqueue.c:3383
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:144
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>

In io_add_aux_cqe(), we should acquire this lock beforehead.

This patch acquires and releases ctx->completion_lock when entering and
exiting io_add_aux_cqe().
---
 io_uring/io_uring.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index 4e2836c9b7bf..0f62332e95ff 100644
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -834,8 +834,10 @@ bool io_post_aux_cqe(struct io_ring_ctx *ctx, u64 user_data, s32 res, u32 cflags
  */
 void io_add_aux_cqe(struct io_ring_ctx *ctx, u64 user_data, s32 res, u32 cflags)
 {
+	io_cq_lock(ctx);
 	__io_post_aux_cqe(ctx, user_data, res, cflags);
 	ctx->submit_state.cq_flush = true;
+	io_cq_unlock_post(ctx);
 }
 
 /*

---
base-commit: 74564adfd3521d9e322cfc345fdc132df80f3c79
change-id: 20240702-bug9-ad8a36681e2d

Best regards,
-- 
Pei Li <[email protected]>


^ permalink raw reply related	[flat|nested] 2+ messages in thread

* Re: [PATCH] io_uring: Fix WARNING in io_cqring_event_overflow
  2024-07-03  0:48 [PATCH] io_uring: Fix WARNING in io_cqring_event_overflow Pei Li
@ 2024-07-03 12:07 ` Jens Axboe
  0 siblings, 0 replies; 2+ messages in thread
From: Jens Axboe @ 2024-07-03 12:07 UTC (permalink / raw)
  To: Pei Li, Pavel Begunkov
  Cc: io-uring, linux-kernel, skhan, syzkaller-bugs,
	linux-kernel-mentees, syzbot+f7f9c893345c5c615d34

On 7/2/24 6:48 PM, Pei Li wrote:
> Acquire ctx->completion_lock in io_add_aux_cqe().
> 
> syzbot reports a warning message in io_cqring_event_overflow(). We were
> supposed to hold ctx->completion_lock before entering this function, but
> instead we did not.
> 
> This patch acquires and releases ctx->completion_lock when entering and
> exiting io_add_aux_cqe().

Thanks for sending a patch, but Pavel already fixed it:

https://git.kernel.dk/cgit/linux/commit/?h=for-6.11/io_uring&id=3b7c16be30e35ec035b2efcc0f7d7b368789c443

-- 
Jens Axboe



^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2024-07-03 12:07 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-07-03  0:48 [PATCH] io_uring: Fix WARNING in io_cqring_event_overflow Pei Li
2024-07-03 12:07 ` Jens Axboe

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox