[PATCH 1/1] io_uring/net: fix fast_iov assignment in io_setup_async_msg()

[PATCH 1/1] io_uring/net: fix fast_iov assignment in io_setup_async_msg()

[Stefan Metzmacher]

I hit a very bad problem during my tests of SENDMSG_ZC.
BUG(); in first_iovec_segment() triggered very easily.
The problem was io_setup_async_msg() in the partial retry case,
which seems to happen more often with _ZC.

iov_iter_iovec_advance() may change i->iov in order to have i->iov_offset
being only relative to the first element.

Which means kmsg->msg.msg_iter.iov is no longer the
same as kmsg->fast_iov.

But this would rewind the copy to be the start of
async_msg->fast_iov, which means the internal
state of sync_msg->msg.msg_iter is inconsitent.

I tested with 5 vectors with length like this 4, 0, 64, 20, 8388608
and got a short writes with:
- ret=2675244 min_ret=8388692 => remaining 5713448 sr->done_io=2675244
- ret=-EAGAIN => io_uring_poll_arm
- ret=4911225 min_ret=5713448 => remaining 802223  sr->done_io=7586469
- ret=-EAGAIN => io_uring_poll_arm
- ret=802223  min_ret=802223  => res=8388692

While this was easily triggered with SENDMSG_ZC (queued for 6.1),
it was a potential problem starting with 7ba89d2af17aa879dda30f5d5d3f152e587fc551
in 5.18 for IORING_OP_RECVMSG.
And also with 4c3c09439c08b03d9503df0ca4c7619c5842892e in 5.19
for IORING_OP_SENDMSG.

However 257e84a5377fbbc336ff563833a8712619acce56 introduced the critical
code into io_setup_async_msg() in 5.11.

Fixes: 7ba89d2af17aa ("io_uring: ensure recv and recvmsg handle MSG_WAITALL correctly")
Fixes: 257e84a5377fb ("io_uring: refactor sendmsg/recvmsg iov managing")
Cc: stable@vger.kernel.org
Signed-off-by: Stefan Metzmacher <metze@samba.org>
---
 io_uring/net.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/io_uring/net.c b/io_uring/net.c
index 60e392f7f2dc..a81fccd38ae4 100644
--- a/io_uring/net.c
+++ b/io_uring/net.c
@@ -165,8 +165,10 @@ static int io_setup_async_msg(struct io_kiocb *req,
 	memcpy(async_msg, kmsg, sizeof(*kmsg));
 	async_msg->msg.msg_name = &async_msg->addr;
 	/* if were using fast_iov, set it to the new one */
-	if (!async_msg->free_iov)
-		async_msg->msg.msg_iter.iov = async_msg->fast_iov;
+	if (!kmsg->free_iov) {
+		size_t fast_idx = kmsg->msg.msg_iter.iov - kmsg->fast_iov;
+		async_msg->msg.msg_iter.iov = &async_msg->fast_iov[fast_idx];
+	}
 
 	return -EAGAIN;
 }
-- 
2.34.1

Re: [PATCH 1/1] io_uring/net: fix fast_iov assignment in io_setup_async_msg()

[Pavel Begunkov]

On 9/29/22 08:39, Stefan Metzmacher wrote:
> I hit a very bad problem during my tests of SENDMSG_ZC.
> BUG(); in first_iovec_segment() triggered very easily.
> The problem was io_setup_async_msg() in the partial retry case,
> which seems to happen more often with _ZC.

Reviewed-by: Pavel Begunkov <asml.silence@gmail.com>

And tested with liburing patches I sent yesterday


> iov_iter_iovec_advance() may change i->iov in order to have i->iov_offset
> being only relative to the first element.
> 
> Which means kmsg->msg.msg_iter.iov is no longer the
> same as kmsg->fast_iov.
> 
> But this would rewind the copy to be the start of
> async_msg->fast_iov, which means the internal
> state of sync_msg->msg.msg_iter is inconsitent.
> 
> I tested with 5 vectors with length like this 4, 0, 64, 20, 8388608
> and got a short writes with:
> - ret=2675244 min_ret=8388692 => remaining 5713448 sr->done_io=2675244
> - ret=-EAGAIN => io_uring_poll_arm
> - ret=4911225 min_ret=5713448 => remaining 802223  sr->done_io=7586469
> - ret=-EAGAIN => io_uring_poll_arm
> - ret=802223  min_ret=802223  => res=8388692
> 
> While this was easily triggered with SENDMSG_ZC (queued for 6.1),
> it was a potential problem starting with 7ba89d2af17aa879dda30f5d5d3f152e587fc551
> in 5.18 for IORING_OP_RECVMSG.
> And also with 4c3c09439c08b03d9503df0ca4c7619c5842892e in 5.19
> for IORING_OP_SENDMSG.
> 
> However 257e84a5377fbbc336ff563833a8712619acce56 introduced the critical
> code into io_setup_async_msg() in 5.11.
> 
> Fixes: 7ba89d2af17aa ("io_uring: ensure recv and recvmsg handle MSG_WAITALL correctly")
> Fixes: 257e84a5377fb ("io_uring: refactor sendmsg/recvmsg iov managing")
> Cc: stable@vger.kernel.org
> Signed-off-by: Stefan Metzmacher <metze@samba.org>
> ---
>   io_uring/net.c | 6 ++++--
>   1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/io_uring/net.c b/io_uring/net.c
> index 60e392f7f2dc..a81fccd38ae4 100644
> --- a/io_uring/net.c
> +++ b/io_uring/net.c
> @@ -165,8 +165,10 @@ static int io_setup_async_msg(struct io_kiocb *req,
>   	memcpy(async_msg, kmsg, sizeof(*kmsg));
>   	async_msg->msg.msg_name = &async_msg->addr;
>   	/* if were using fast_iov, set it to the new one */
> -	if (!async_msg->free_iov)
> -		async_msg->msg.msg_iter.iov = async_msg->fast_iov;
> +	if (!kmsg->free_iov) {
> +		size_t fast_idx = kmsg->msg.msg_iter.iov - kmsg->fast_iov;
> +		async_msg->msg.msg_iter.iov = &async_msg->fast_iov[fast_idx];
> +	}
>   
>   	return -EAGAIN;
>   }

-- 
Pavel Begunkov

Re: [PATCH 1/1] io_uring/net: fix fast_iov assignment in io_setup_async_msg()

[Jens Axboe]

On Thu, 29 Sep 2022 09:39:10 +0200, Stefan Metzmacher wrote:
> I hit a very bad problem during my tests of SENDMSG_ZC.
> BUG(); in first_iovec_segment() triggered very easily.
> The problem was io_setup_async_msg() in the partial retry case,
> which seems to happen more often with _ZC.
> 
> iov_iter_iovec_advance() may change i->iov in order to have i->iov_offset
> being only relative to the first element.
> 
> [...]

Applied, thanks!

[1/1] io_uring/net: fix fast_iov assignment in io_setup_async_msg()
      commit: 3e4cb6ebbb2bad201c1186bc0b7e8cf41dd7f7e6

Best regards,
-- 
Jens Axboe