* [PATCH 1/1] io_uring/net: fix fast_iov assignment in io_setup_async_msg() [not found] <[email protected]> @ 2022-09-29 7:39 ` Stefan Metzmacher 2022-09-29 12:53 ` Pavel Begunkov 2022-09-29 13:13 ` Jens Axboe 0 siblings, 2 replies; 3+ messages in thread From: Stefan Metzmacher @ 2022-09-29 7:39 UTC (permalink / raw) To: io-uring, axboe, asml.silence; +Cc: Stefan Metzmacher, stable I hit a very bad problem during my tests of SENDMSG_ZC. BUG(); in first_iovec_segment() triggered very easily. The problem was io_setup_async_msg() in the partial retry case, which seems to happen more often with _ZC. iov_iter_iovec_advance() may change i->iov in order to have i->iov_offset being only relative to the first element. Which means kmsg->msg.msg_iter.iov is no longer the same as kmsg->fast_iov. But this would rewind the copy to be the start of async_msg->fast_iov, which means the internal state of sync_msg->msg.msg_iter is inconsitent. I tested with 5 vectors with length like this 4, 0, 64, 20, 8388608 and got a short writes with: - ret=2675244 min_ret=8388692 => remaining 5713448 sr->done_io=2675244 - ret=-EAGAIN => io_uring_poll_arm - ret=4911225 min_ret=5713448 => remaining 802223 sr->done_io=7586469 - ret=-EAGAIN => io_uring_poll_arm - ret=802223 min_ret=802223 => res=8388692 While this was easily triggered with SENDMSG_ZC (queued for 6.1), it was a potential problem starting with 7ba89d2af17aa879dda30f5d5d3f152e587fc551 in 5.18 for IORING_OP_RECVMSG. And also with 4c3c09439c08b03d9503df0ca4c7619c5842892e in 5.19 for IORING_OP_SENDMSG. However 257e84a5377fbbc336ff563833a8712619acce56 introduced the critical code into io_setup_async_msg() in 5.11. Fixes: 7ba89d2af17aa ("io_uring: ensure recv and recvmsg handle MSG_WAITALL correctly") Fixes: 257e84a5377fb ("io_uring: refactor sendmsg/recvmsg iov managing") Cc: [email protected] Signed-off-by: Stefan Metzmacher <[email protected]> --- io_uring/net.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/io_uring/net.c b/io_uring/net.c index 60e392f7f2dc..a81fccd38ae4 100644 --- a/io_uring/net.c +++ b/io_uring/net.c @@ -165,8 +165,10 @@ static int io_setup_async_msg(struct io_kiocb *req, memcpy(async_msg, kmsg, sizeof(*kmsg)); async_msg->msg.msg_name = &async_msg->addr; /* if were using fast_iov, set it to the new one */ - if (!async_msg->free_iov) - async_msg->msg.msg_iter.iov = async_msg->fast_iov; + if (!kmsg->free_iov) { + size_t fast_idx = kmsg->msg.msg_iter.iov - kmsg->fast_iov; + async_msg->msg.msg_iter.iov = &async_msg->fast_iov[fast_idx]; + } return -EAGAIN; } -- 2.34.1 ^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH 1/1] io_uring/net: fix fast_iov assignment in io_setup_async_msg() 2022-09-29 7:39 ` [PATCH 1/1] io_uring/net: fix fast_iov assignment in io_setup_async_msg() Stefan Metzmacher @ 2022-09-29 12:53 ` Pavel Begunkov 2022-09-29 13:13 ` Jens Axboe 1 sibling, 0 replies; 3+ messages in thread From: Pavel Begunkov @ 2022-09-29 12:53 UTC (permalink / raw) To: Stefan Metzmacher, io-uring, axboe; +Cc: stable On 9/29/22 08:39, Stefan Metzmacher wrote: > I hit a very bad problem during my tests of SENDMSG_ZC. > BUG(); in first_iovec_segment() triggered very easily. > The problem was io_setup_async_msg() in the partial retry case, > which seems to happen more often with _ZC. Reviewed-by: Pavel Begunkov <[email protected]> And tested with liburing patches I sent yesterday > iov_iter_iovec_advance() may change i->iov in order to have i->iov_offset > being only relative to the first element. > > Which means kmsg->msg.msg_iter.iov is no longer the > same as kmsg->fast_iov. > > But this would rewind the copy to be the start of > async_msg->fast_iov, which means the internal > state of sync_msg->msg.msg_iter is inconsitent. > > I tested with 5 vectors with length like this 4, 0, 64, 20, 8388608 > and got a short writes with: > - ret=2675244 min_ret=8388692 => remaining 5713448 sr->done_io=2675244 > - ret=-EAGAIN => io_uring_poll_arm > - ret=4911225 min_ret=5713448 => remaining 802223 sr->done_io=7586469 > - ret=-EAGAIN => io_uring_poll_arm > - ret=802223 min_ret=802223 => res=8388692 > > While this was easily triggered with SENDMSG_ZC (queued for 6.1), > it was a potential problem starting with 7ba89d2af17aa879dda30f5d5d3f152e587fc551 > in 5.18 for IORING_OP_RECVMSG. > And also with 4c3c09439c08b03d9503df0ca4c7619c5842892e in 5.19 > for IORING_OP_SENDMSG. > > However 257e84a5377fbbc336ff563833a8712619acce56 introduced the critical > code into io_setup_async_msg() in 5.11. > > Fixes: 7ba89d2af17aa ("io_uring: ensure recv and recvmsg handle MSG_WAITALL correctly") > Fixes: 257e84a5377fb ("io_uring: refactor sendmsg/recvmsg iov managing") > Cc: [email protected] > Signed-off-by: Stefan Metzmacher <[email protected]> > --- > io_uring/net.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > > diff --git a/io_uring/net.c b/io_uring/net.c > index 60e392f7f2dc..a81fccd38ae4 100644 > --- a/io_uring/net.c > +++ b/io_uring/net.c > @@ -165,8 +165,10 @@ static int io_setup_async_msg(struct io_kiocb *req, > memcpy(async_msg, kmsg, sizeof(*kmsg)); > async_msg->msg.msg_name = &async_msg->addr; > /* if were using fast_iov, set it to the new one */ > - if (!async_msg->free_iov) > - async_msg->msg.msg_iter.iov = async_msg->fast_iov; > + if (!kmsg->free_iov) { > + size_t fast_idx = kmsg->msg.msg_iter.iov - kmsg->fast_iov; > + async_msg->msg.msg_iter.iov = &async_msg->fast_iov[fast_idx]; > + } > > return -EAGAIN; > } -- Pavel Begunkov ^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH 1/1] io_uring/net: fix fast_iov assignment in io_setup_async_msg() 2022-09-29 7:39 ` [PATCH 1/1] io_uring/net: fix fast_iov assignment in io_setup_async_msg() Stefan Metzmacher 2022-09-29 12:53 ` Pavel Begunkov @ 2022-09-29 13:13 ` Jens Axboe 1 sibling, 0 replies; 3+ messages in thread From: Jens Axboe @ 2022-09-29 13:13 UTC (permalink / raw) To: io-uring, Stefan Metzmacher, asml.silence; +Cc: stable On Thu, 29 Sep 2022 09:39:10 +0200, Stefan Metzmacher wrote: > I hit a very bad problem during my tests of SENDMSG_ZC. > BUG(); in first_iovec_segment() triggered very easily. > The problem was io_setup_async_msg() in the partial retry case, > which seems to happen more often with _ZC. > > iov_iter_iovec_advance() may change i->iov in order to have i->iov_offset > being only relative to the first element. > > [...] Applied, thanks! [1/1] io_uring/net: fix fast_iov assignment in io_setup_async_msg() commit: 3e4cb6ebbb2bad201c1186bc0b7e8cf41dd7f7e6 Best regards, -- Jens Axboe ^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-09-29 13:13 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <[email protected]>
2022-09-29 7:39 ` [PATCH 1/1] io_uring/net: fix fast_iov assignment in io_setup_async_msg() Stefan Metzmacher
2022-09-29 12:53 ` Pavel Begunkov
2022-09-29 13:13 ` Jens Axboe
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox