public inbox for [email protected]
 help / color / mirror / Atom feed
From: Pavel Begunkov <[email protected]>
To: Jens Axboe <[email protected]>, [email protected]
Subject: [PATCH 01/10] io_uring: fix refs underflow in io_iopoll_queue()
Date: Sun, 28 Jun 2020 12:52:29 +0300	[thread overview]
Message-ID: <8122af4ead0571f80143c3509d71cae16b17535a.1593337097.git.asml.silence@gmail.com> (raw)
In-Reply-To: <[email protected]>

Now io_complete_rw_common() puts a ref, extra io_req_put()
in io_iopoll_queue() causes undeflow. Remove it.

[  455.998620] refcount_t: underflow; use-after-free.
[  455.998743] WARNING: CPU: 6 PID: 285394 at lib/refcount.c:28
	refcount_warn_saturate+0xae/0xf0
[  455.998772] CPU: 6 PID: 285394 Comm: read-write2 Tainted: G
          I E     5.8.0-rc2-00048-g1b1aa738f167-dirty #509
[  455.998772] RIP: 0010:refcount_warn_saturate+0xae/0xf0
...
[  455.998778] Call Trace:
[  455.998778]  io_put_req+0x44/0x50
[  455.998778]  io_iopoll_complete+0x245/0x370
[  455.998779]  io_iopoll_getevents+0x12f/0x1a0
[  455.998779]  io_iopoll_reap_events.part.0+0x5e/0xa0
[  455.998780]  io_ring_ctx_wait_and_kill+0x132/0x1c0
[  455.998780]  io_uring_release+0x20/0x30
[  455.998780]  __fput+0xcd/0x230
[  455.998781]  ____fput+0xe/0x10
[  455.998781]  task_work_run+0x67/0xa0
[  455.998781]  do_exit+0x35d/0xb70
[  455.998782]  do_group_exit+0x43/0xa0
[  455.998783]  get_signal+0x140/0x900
[  455.998783]  do_signal+0x37/0x780
[  455.998784]  __prepare_exit_to_usermode+0x126/0x1c0
[  455.998785]  __syscall_return_slowpath+0x3b/0x1c0
[  455.998785]  do_syscall_64+0x5f/0xa0
[  455.998785]  entry_SYSCALL_64_after_hwframe+0x44/0xa9

Fixes: a1d7c393c47 ("io_uring: enable READ/WRITE to use deferred completions")
Signed-off-by: Pavel Begunkov <[email protected]>
---
 fs/io_uring.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/fs/io_uring.c b/fs/io_uring.c
index bf236ba10601..52441f2465fe 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -1904,7 +1904,6 @@ static void io_iopoll_queue(struct list_head *again)
 		/* shouldn't happen unless io_uring is dying, cancel reqs */
 		if (unlikely(!current->mm)) {
 			io_complete_rw_common(&req->rw.kiocb, -EAGAIN, NULL);
-			io_put_req(req);
 			continue;
 		}
 
-- 
2.24.0


  reply	other threads:[~2020-06-28  9:54 UTC|newest]

Thread overview: 14+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-06-28  9:52 [PATCH 00/10] some fixing + refactoring batch-free Pavel Begunkov
2020-06-28  9:52 ` Pavel Begunkov [this message]
2020-06-28  9:52 ` [PATCH 02/10] io_uring: remove inflight batching in free_many() Pavel Begunkov
2020-06-28  9:52 ` [PATCH 03/10] io_uring: dismantle req early and remove need_iter Pavel Begunkov
2020-06-28  9:52 ` [PATCH 04/10] io_uring: batch-free linked reqs as well Pavel Begunkov
2020-06-28  9:52 ` [PATCH 05/10] io_uring: cosmetic changes for batch free Pavel Begunkov
2020-06-28  9:52 ` [PATCH 06/10] io_uring: kill REQ_F_LINK_NEXT Pavel Begunkov
2020-06-28  9:52 ` [PATCH 07/10] io_uring: clean up req->result setting by rw Pavel Begunkov
2020-06-28  9:52 ` [PATCH 08/10] io_uring: fix missing wake_up io_rw_reissue() Pavel Begunkov
2020-06-28 14:12   ` Jens Axboe
2020-06-28 14:48     ` Pavel Begunkov
2020-06-28  9:52 ` [PATCH 09/10] io_uring: do task_work_run() during iopoll Pavel Begunkov
2020-06-28  9:52 ` [PATCH 10/10] io_uring: fix iopoll -EAGAIN handling Pavel Begunkov
2020-06-28 14:09 ` [PATCH 00/10] some fixing + refactoring batch-free Jens Axboe

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=8122af4ead0571f80143c3509d71cae16b17535a.1593337097.git.asml.silence@gmail.com \
    [email protected] \
    [email protected] \
    [email protected] \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox