public inbox for [email protected]
 help / color / mirror / Atom feed
From: Jens Axboe <[email protected]>
To: Al Viro <[email protected]>,
	Pavel Begunkov <[email protected]>
Cc: [email protected], [email protected],
	Linus Torvalds <[email protected]>
Subject: Re: [PATCH 3/3] io_uring: refactor io_sq_offload_create()
Date: Thu, 22 Jul 2021 17:06:24 -0600	[thread overview]
Message-ID: <[email protected]> (raw)
In-Reply-To: <[email protected]>

On 7/22/21 3:59 PM, Al Viro wrote:
> On Tue, Apr 20, 2021 at 12:03:33PM +0100, Pavel Begunkov wrote:
>> Just a bit of code tossing in io_sq_offload_create(), so it looks a bit
>> better. No functional changes.
> 
> Does a use-after-free count as a functional change?
> 
>>  		f = fdget(p->wq_fd);
> 
> Descriptor table is shared with another thread, grabbed a reference to file.
> Refcount is 2 (1 from descriptor table, 1 held by us)
> 
>>  		if (!f.file)
>>  			return -ENXIO;
> 
> Nope, not NULL.
> 
>> -		if (f.file->f_op != &io_uring_fops) {
>> -			fdput(f);
>> -			return -EINVAL;
>> -		}
>>  		fdput(f);
> 
> Decrement refcount, get preempted away.  f.file->f_count is 1 now.
> 
> Another thread: close() on the same descriptor.  Final reference to
> struct file (from descriptor table) is gone, file closed, memory freed.
> 
> Regain CPU...
> 
>> +		if (f.file->f_op != &io_uring_fops)
>> +			return -EINVAL;
> 
> ... and dereference an already freed structure.
> 
> What scares me here is that you are playing with bloody fundamental
> objects, without understanding even the basics regarding their
> handling ;-/

Let's calm down here, no need to resort to hyperbole. It looks like an
honest mistake to me, and I should have caught that in review. You don't
even need to understand file structure life times to realize that:

	put(shared_struct);
	if (shared_struct->foo)
		...

is a bad idea. Which Pavel obviously does.

But yes, that is not great and obviously a bug, and we'll of course get
it fixed up asap.

-- 
Jens Axboe


  reply	other threads:[~2021-07-22 23:06 UTC|newest]

Thread overview: 26+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-04-20 11:03 [PATCH 0/3] small 5.13 cleanups Pavel Begunkov
2021-04-20 11:03 ` [PATCH 1/3] io_uring: move inflight un-tracking into cleanup Pavel Begunkov
2021-04-20 11:03 ` [PATCH 2/3] io_uring: safer sq_creds putting Pavel Begunkov
2021-04-20 11:03 ` [PATCH 3/3] io_uring: refactor io_sq_offload_create() Pavel Begunkov
2021-07-22 21:59   ` Al Viro
2021-07-22 23:06     ` Jens Axboe [this message]
2021-07-22 23:30       ` Al Viro
2021-07-22 23:42         ` Jens Axboe
2021-07-23  0:10           ` Al Viro
2021-07-23  0:12             ` Al Viro
2021-07-23 16:17             ` Jens Axboe
2021-07-23 17:11               ` Al Viro
2021-07-23 17:32                 ` Jens Axboe
2021-07-23 17:36                   ` Jens Axboe
2021-07-23 17:56                     ` Jens Axboe
2021-07-23 19:00                       ` Al Viro
2021-07-23 20:10                         ` Jens Axboe
2021-07-23 20:24                           ` Al Viro
2021-07-23 22:32                             ` Jens Axboe
2021-07-23 20:19                         ` Al Viro
2021-07-23 23:45                           ` Matthew Wilcox
2021-07-23 23:57                             ` Jens Axboe
2021-07-24  1:31                             ` Al Viro
2021-07-23  0:03         ` Al Viro
2021-07-23  9:59     ` Pavel Begunkov
2021-04-20 18:55 ` [PATCH 0/3] small 5.13 cleanups Jens Axboe

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    [email protected] \
    [email protected] \
    [email protected] \
    [email protected] \
    [email protected] \
    [email protected] \
    [email protected] \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox