public inbox for [email protected]
 help / color / mirror / Atom feed
* [PATCH for-current 0/2] sqo files/mm fixes
@ 2021-01-11  4:00 Pavel Begunkov
  2021-01-11  4:00 ` [PATCH 1/2] io_uring: drop mm and files after task_work_run Pavel Begunkov
                   ` (2 more replies)
  0 siblings, 3 replies; 6+ messages in thread
From: Pavel Begunkov @ 2021-01-11  4:00 UTC (permalink / raw)
  To: Jens Axboe, io-uring

Neither of issues is confirmed, but should be a good hardening in any
case. Inefficiencies will be removed for-next.

Pavel Begunkov (2):
  io_uring: drop mm and files after task_work_run
  io_uring: don't take files/mm for a dead task

 fs/io_uring.c | 7 +++++++
 1 file changed, 7 insertions(+)

-- 
2.24.0


^ permalink raw reply	[flat|nested] 6+ messages in thread

* [PATCH 1/2] io_uring: drop mm and files after task_work_run
  2021-01-11  4:00 [PATCH for-current 0/2] sqo files/mm fixes Pavel Begunkov
@ 2021-01-11  4:00 ` Pavel Begunkov
  2021-01-11  4:00 ` [PATCH 2/2] io_uring: don't take files/mm for a dead task Pavel Begunkov
  2021-01-14 21:12 ` [PATCH for-current 0/2] sqo files/mm fixes Pavel Begunkov
  2 siblings, 0 replies; 6+ messages in thread
From: Pavel Begunkov @ 2021-01-11  4:00 UTC (permalink / raw)
  To: Jens Axboe, io-uring; +Cc: stable

__io_req_task_submit() run by task_work can set mm and files, but
io_sq_thread() in some cases, and because __io_sq_thread_acquire_mm()
and __io_sq_thread_acquire_files() do a simple current->mm/files check
it may end up submitting IO with mm/files of another task.

We also need to drop it after in the end to drop potentially grabbed
references to them.

Cc: [email protected] # 5.9+
Signed-off-by: Pavel Begunkov <[email protected]>
---
 fs/io_uring.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 2f305c097bd5..7af74c1ec909 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -7056,6 +7056,7 @@ static int io_sq_thread(void *data)
 
 		if (sqt_spin || !time_after(jiffies, timeout)) {
 			io_run_task_work();
+			io_sq_thread_drop_mm_files();
 			cond_resched();
 			if (sqt_spin)
 				timeout = jiffies + sqd->sq_thread_idle;
@@ -7093,6 +7094,7 @@ static int io_sq_thread(void *data)
 	}
 
 	io_run_task_work();
+	io_sq_thread_drop_mm_files();
 
 	if (cur_css)
 		io_sq_thread_unassociate_blkcg();
-- 
2.24.0


^ permalink raw reply related	[flat|nested] 6+ messages in thread

* [PATCH 2/2] io_uring: don't take files/mm for a dead task
  2021-01-11  4:00 [PATCH for-current 0/2] sqo files/mm fixes Pavel Begunkov
  2021-01-11  4:00 ` [PATCH 1/2] io_uring: drop mm and files after task_work_run Pavel Begunkov
@ 2021-01-11  4:00 ` Pavel Begunkov
  2021-01-14 21:12 ` [PATCH for-current 0/2] sqo files/mm fixes Pavel Begunkov
  2 siblings, 0 replies; 6+ messages in thread
From: Pavel Begunkov @ 2021-01-11  4:00 UTC (permalink / raw)
  To: Jens Axboe, io-uring; +Cc: stable

In rare cases a task may be exiting while io_ring_exit_work() trying to
cancel/wait its requests. It's ok for __io_sq_thread_acquire_mm()
because of SQPOLL check, but is not for __io_sq_thread_acquire_files().
Play safe and fail for both of them.

Cc: [email protected] # 5.5+
Signed-off-by: Pavel Begunkov <[email protected]>
---
 fs/io_uring.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 7af74c1ec909..b0e6d8e607a3 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -1106,6 +1106,9 @@ static void io_sq_thread_drop_mm_files(void)
 
 static int __io_sq_thread_acquire_files(struct io_ring_ctx *ctx)
 {
+	if (current->flags & PF_EXITING)
+		return -EFAULT;
+
 	if (!current->files) {
 		struct files_struct *files;
 		struct nsproxy *nsproxy;
@@ -1133,6 +1136,8 @@ static int __io_sq_thread_acquire_mm(struct io_ring_ctx *ctx)
 {
 	struct mm_struct *mm;
 
+	if (current->flags & PF_EXITING)
+		return -EFAULT;
 	if (current->mm)
 		return 0;
 
-- 
2.24.0


^ permalink raw reply related	[flat|nested] 6+ messages in thread

* Re: [PATCH for-current 0/2] sqo files/mm fixes
  2021-01-11  4:00 [PATCH for-current 0/2] sqo files/mm fixes Pavel Begunkov
  2021-01-11  4:00 ` [PATCH 1/2] io_uring: drop mm and files after task_work_run Pavel Begunkov
  2021-01-11  4:00 ` [PATCH 2/2] io_uring: don't take files/mm for a dead task Pavel Begunkov
@ 2021-01-14 21:12 ` Pavel Begunkov
  2021-01-14 23:28   ` Jens Axboe
  2 siblings, 1 reply; 6+ messages in thread
From: Pavel Begunkov @ 2021-01-14 21:12 UTC (permalink / raw)
  To: Jens Axboe, io-uring

On 11/01/2021 04:00, Pavel Begunkov wrote:
> Neither of issues is confirmed, but should be a good hardening in any
> case. Inefficiencies will be removed for-next.

A reminder just in case it was lost

> 
> Pavel Begunkov (2):
>   io_uring: drop mm and files after task_work_run
>   io_uring: don't take files/mm for a dead task
> 
>  fs/io_uring.c | 7 +++++++
>  1 file changed, 7 insertions(+)
> 

-- 
Pavel Begunkov

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: [PATCH for-current 0/2] sqo files/mm fixes
  2021-01-14 21:12 ` [PATCH for-current 0/2] sqo files/mm fixes Pavel Begunkov
@ 2021-01-14 23:28   ` Jens Axboe
  2021-01-15 12:33     ` Pavel Begunkov
  0 siblings, 1 reply; 6+ messages in thread
From: Jens Axboe @ 2021-01-14 23:28 UTC (permalink / raw)
  To: Pavel Begunkov, io-uring

On 1/14/21 2:12 PM, Pavel Begunkov wrote:
> On 11/01/2021 04:00, Pavel Begunkov wrote:
>> Neither of issues is confirmed, but should be a good hardening in any
>> case. Inefficiencies will be removed for-next.
> 
> A reminder just in case it was lost

Maybe I forgot to send out a reply, but they are in the io_uring-5.11
branch.

-- 
Jens Axboe


^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: [PATCH for-current 0/2] sqo files/mm fixes
  2021-01-14 23:28   ` Jens Axboe
@ 2021-01-15 12:33     ` Pavel Begunkov
  0 siblings, 0 replies; 6+ messages in thread
From: Pavel Begunkov @ 2021-01-15 12:33 UTC (permalink / raw)
  To: Jens Axboe, io-uring

On 14/01/2021 23:28, Jens Axboe wrote:
> On 1/14/21 2:12 PM, Pavel Begunkov wrote:
>> On 11/01/2021 04:00, Pavel Begunkov wrote:
>>> Neither of issues is confirmed, but should be a good hardening in any
>>> case. Inefficiencies will be removed for-next.
>>
>> A reminder just in case it was lost
> 
> Maybe I forgot to send out a reply, but they are in the io_uring-5.11
> branch.

Missed it in the tree. Thanks!

-- 
Pavel Begunkov

^ permalink raw reply	[flat|nested] 6+ messages in thread

end of thread, other threads:[~2021-01-15 12:47 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2021-01-11  4:00 [PATCH for-current 0/2] sqo files/mm fixes Pavel Begunkov
2021-01-11  4:00 ` [PATCH 1/2] io_uring: drop mm and files after task_work_run Pavel Begunkov
2021-01-11  4:00 ` [PATCH 2/2] io_uring: don't take files/mm for a dead task Pavel Begunkov
2021-01-14 21:12 ` [PATCH for-current 0/2] sqo files/mm fixes Pavel Begunkov
2021-01-14 23:28   ` Jens Axboe
2021-01-15 12:33     ` Pavel Begunkov

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox