From: Jens Axboe <[email protected]>
To: Al Viro <[email protected]>,
Pavel Begunkov <[email protected]>
Cc: [email protected], [email protected],
Linus Torvalds <[email protected]>
Subject: Re: [PATCH 3/3] io_uring: refactor io_sq_offload_create()
Date: Thu, 22 Jul 2021 17:06:24 -0600 [thread overview]
Message-ID: <[email protected]> (raw)
In-Reply-To: <[email protected]>
On 7/22/21 3:59 PM, Al Viro wrote:
> On Tue, Apr 20, 2021 at 12:03:33PM +0100, Pavel Begunkov wrote:
>> Just a bit of code tossing in io_sq_offload_create(), so it looks a bit
>> better. No functional changes.
>
> Does a use-after-free count as a functional change?
>
>> f = fdget(p->wq_fd);
>
> Descriptor table is shared with another thread, grabbed a reference to file.
> Refcount is 2 (1 from descriptor table, 1 held by us)
>
>> if (!f.file)
>> return -ENXIO;
>
> Nope, not NULL.
>
>> - if (f.file->f_op != &io_uring_fops) {
>> - fdput(f);
>> - return -EINVAL;
>> - }
>> fdput(f);
>
> Decrement refcount, get preempted away. f.file->f_count is 1 now.
>
> Another thread: close() on the same descriptor. Final reference to
> struct file (from descriptor table) is gone, file closed, memory freed.
>
> Regain CPU...
>
>> + if (f.file->f_op != &io_uring_fops)
>> + return -EINVAL;
>
> ... and dereference an already freed structure.
>
> What scares me here is that you are playing with bloody fundamental
> objects, without understanding even the basics regarding their
> handling ;-/
Let's calm down here, no need to resort to hyperbole. It looks like an
honest mistake to me, and I should have caught that in review. You don't
even need to understand file structure life times to realize that:
put(shared_struct);
if (shared_struct->foo)
...
is a bad idea. Which Pavel obviously does.
But yes, that is not great and obviously a bug, and we'll of course get
it fixed up asap.
--
Jens Axboe
next prev parent reply other threads:[~2021-07-22 23:06 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-04-20 11:03 [PATCH 0/3] small 5.13 cleanups Pavel Begunkov
2021-04-20 11:03 ` [PATCH 1/3] io_uring: move inflight un-tracking into cleanup Pavel Begunkov
2021-04-20 11:03 ` [PATCH 2/3] io_uring: safer sq_creds putting Pavel Begunkov
2021-04-20 11:03 ` [PATCH 3/3] io_uring: refactor io_sq_offload_create() Pavel Begunkov
2021-07-22 21:59 ` Al Viro
2021-07-22 23:06 ` Jens Axboe [this message]
2021-07-22 23:30 ` Al Viro
2021-07-22 23:42 ` Jens Axboe
2021-07-23 0:10 ` Al Viro
2021-07-23 0:12 ` Al Viro
2021-07-23 16:17 ` Jens Axboe
2021-07-23 17:11 ` Al Viro
2021-07-23 17:32 ` Jens Axboe
2021-07-23 17:36 ` Jens Axboe
2021-07-23 17:56 ` Jens Axboe
2021-07-23 19:00 ` Al Viro
2021-07-23 20:10 ` Jens Axboe
2021-07-23 20:24 ` Al Viro
2021-07-23 22:32 ` Jens Axboe
2021-07-23 20:19 ` Al Viro
2021-07-23 23:45 ` Matthew Wilcox
2021-07-23 23:57 ` Jens Axboe
2021-07-24 1:31 ` Al Viro
2021-07-23 0:03 ` Al Viro
2021-07-23 9:59 ` Pavel Begunkov
2021-04-20 18:55 ` [PATCH 0/3] small 5.13 cleanups Jens Axboe
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
[email protected] \
[email protected] \
[email protected] \
[email protected] \
[email protected] \
[email protected] \
[email protected] \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox