public inbox for [email protected]
 help / color / mirror / Atom feed
* [RFC] migrating mm
@ 2019-11-12 11:14 Pavel Begunkov
  2019-11-12 12:23 ` Pavel Begunkov
  0 siblings, 1 reply; 2+ messages in thread
From: Pavel Begunkov @ 2019-11-12 11:14 UTC (permalink / raw)
  To: Jens Axboe, io-uring

There is a case I'm not sure about, but which bothers me.
What would happen, if we try to use io_uring with offloading (i.e.
IORING_SETUP_SQPOLL), after its creator is gone? The thing is that
io_sq_thread() is getting mm by using ctx->sqo_mm, which is current->mm
of the creator process, which potentially may be released.


The case in mind:
let: @parent has a @child process

@child:
    uring_fd = io_uring_create(IORING_SETUP_SQPOLL)
    pass_fd_via_pipe(uring_fd, to=@parent);
    exit()

@parent:
    uring_fd = get_fd_from_pipe()
    wait(@child)

    sqe = create_sqe_which_needs_mm();
    io_submit_sqe(uring_fd, sqe)
    // io_uring tries to grab mm of @child, which is gone.



What do you think?

-- 
Pavel Begunkov

^ permalink raw reply	[flat|nested] 2+ messages in thread

* Re: [RFC] migrating mm
  2019-11-12 11:14 [RFC] migrating mm Pavel Begunkov
@ 2019-11-12 12:23 ` Pavel Begunkov
  0 siblings, 0 replies; 2+ messages in thread
From: Pavel Begunkov @ 2019-11-12 12:23 UTC (permalink / raw)
  To: Jens Axboe, io-uring

On 11/12/2019 2:14 PM, Pavel Begunkov wrote:
> There is a case I'm not sure about, but which bothers me.
> What would happen, if we try to use io_uring with offloading (i.e.
> IORING_SETUP_SQPOLL), after its creator is gone? The thing is that
> io_sq_thread() is getting mm by using ctx->sqo_mm, which is current->mm
> of the creator process, which potentially may be released.
> 

Please ignore this. The answer is obvious, I just missed
mmgrab(current->mm) right at the beginning of io_sq_offload_start().


> 
> The case in mind:
> let: @parent has a @child process
> 
> @child:
>     uring_fd = io_uring_create(IORING_SETUP_SQPOLL)
>     pass_fd_via_pipe(uring_fd, to=@parent);
>     exit()
> 
> @parent:
>     uring_fd = get_fd_from_pipe()
>     wait(@child)
> 
>     sqe = create_sqe_which_needs_mm();
>     io_submit_sqe(uring_fd, sqe)
>     // io_uring tries to grab mm of @child, which is gone.
> 
> 
> 
> What do you think?
> 

^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2019-11-12 12:23 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2019-11-12 11:14 [RFC] migrating mm Pavel Begunkov
2019-11-12 12:23 ` Pavel Begunkov

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox