Re: [GIT PULL] io_uring fixes for 6.0-rc1

[Linus Torvalds <torvalds@linux-foundation.org>]

On Fri, Aug 12, 2022 at 2:43 PM Linus Torvalds
<torvalds@linux-foundation.org> wrote:
>
> I think was seeing others (I got hundreds of lines or errors), but now
> that I've blown things away I can't recreate it. My allmodconfig build
> just completed with no sign of the errors I saw earlier.

Oh, and immediately after sending that email,  I got the errors back.

Because of the randstruct issue, I did another "git clean" (to make
sure the random seed was gone and recreated) and started a new
allmodconfig build.

And now I see the error again.

It does seem to be only 'struct io_cmd_data', but since this seems to
be about random layout, who knows. The "hundreds of lines" is because
each error report ends up being something like 25 lines in size, so
you don't need a lot of them to get lots and lots of lines.

The ones I see in my *current* build are all that

  496 |         BUILD_BUG_ON(cmd_sz > sizeof(struct io_cmd_data));

add there's apparently six of them (so the "hundreds of lines" was
apparently "only" 150 lines of errors), here's the concise "inlined
from" info:

    inlined from ‘io_prep_rw’ at io_uring/rw.c:38:21:
    inlined from ‘__io_import_iovec’ at io_uring/rw.c:353:21,
    inlined from ‘io_import_iovec’ at io_uring/rw.c:406:11,
    inlined from ‘io_rw_prep_async’ at io_uring/rw.c:538:8,
    inlined from ‘io_readv_prep_async’ at io_uring/rw.c:551:9:
    inlined from ‘io_read’ at io_uring/rw.c:697:21:
    inlined from ‘io_write’ at io_uring/rw.c:842:21:
    inlined from ‘io_do_iopoll’ at io_uring/rw.c:997:22:

in case that helps.

Anyway, the way to recreate this is apparently

 (a) make sure you have the gcc plugins enabled

 (b) do "git clean -dqfx" between builds

 (c) do "make allmodconfig ; make -j64" until you see it.

I don't know what the chance of it happening is, but I'm starting my
fourth iteration, and I am just now seen it for the third time.

So it seems fairly easy to trigger, even if it's not 100%.

And yes, on this latest case it was once again "struct io_cmd_data".

So I think that may be the only case.

              Linus