Re: [PATCH v2] io_uring: fix dead-hung for non-iter fixed rw

[Jens Axboe <axboe@kernel.dk>]

> On Nov 24, 2019, at 8:38 PM, Jackie Liu <jackieliu@byteisland.com> wrote:
> 
> 
> 
>> 2019年11月25日 10:38，Jens Axboe <axboe@kernel.dk> 写道：
>> 
>>> On 11/24/19 5:43 PM, Jackie Liu wrote:
>>> 
>>> 
>>>> 2019年11月25日 01:52，Pavel Begunkov <asml.silence@gmail.com> 写道：
>>>> 
>>>> On 24/11/2019 20:10, Jens Axboe wrote:
>>>>> On 11/24/19 1:58 AM, Pavel Begunkov wrote:
>>>>>> Read/write requests to devices without implemented read/write_iter
>>>>>> using fixed buffers causes general protection fault, which totally
>>>>>> hangs a machine.
>>>>>> 
>>>>>> io_import_fixed() initialises iov_iter with bvec, but loop_rw_iter()
>>>>>> accesses it as iovec, so dereferencing random address.
>>>>>> 
>>>>>> kmap() page by page in this case
>>>>> 
>>>>> This looks good to me, much cleaner/simpler. I've added a few pipe fixed
>>>>> buffer tests to liburing as well. Didn't crash for me, but obvious
>>>>> garbage coming out. I've flagged this for stable as well.
>>>>> 
>>>> The problem I have is that __user pointer is meant to be checked
>>>> for not being a kernel address. I suspect, it could fail in some
>>>> device, which double checks the pointer after vfs (e.g. using access_ok()).
>>>> Am I wrong? Not a fault at least...
>>>> 
>>>> #define access_ok(...) __range_not_ok(addr, user_addr_max());
>>>> 
>>>> BTW, is there anybody testing it for non x86-64 arch?
>>>> 
>>> 
>>> I have some aarch64 platform, What test do you want me to do?
>> 
>> A basic one to try would be:
>> 
>> axboe@x1:/home/axboe/git/liburing $ test/stdout 
>> This is a pipe test
>> This is a fixed pipe test
>> 
>> But in general I'd just run make runtests in the liburing directory
>> and go through all of them.
>> 
> 
> For test/stdout is PASS. Tested-by: Jackie Liu <liuyun01@kylinos.cn>

Thanks!

> But test/accept-link and test/fixed-link failed in for-5.5/io_uring-post branch.
> that is expect?

Yes, the fix for that is in 5.4, didn’t merge it into the 5.5 branch. It’ll pass once Linus pulls the 5.5 bits and the branches merge. 

— 
Jens Axboe