public inbox for [email protected]
 help / color / mirror / Atom feed
* [RFC][BUG] io_uring: fix work corruption for poll_add
@ 2020-07-23 18:12 Pavel Begunkov
  2020-07-23 18:15 ` Pavel Begunkov
  2020-07-23 22:16 ` Jens Axboe
  0 siblings, 2 replies; 10+ messages in thread
From: Pavel Begunkov @ 2020-07-23 18:12 UTC (permalink / raw)
  To: Jens Axboe, io-uring

poll_add can have req->work initialised, which will be overwritten in
__io_arm_poll_handler() because of the union. Luckily, hash_node is
zeroed in the end, so the damage is limited to lost put for work.creds,
and probably corrupted work.list.

That's the easiest and really dirty fix, which rearranges members in the
union, arm_poll*() modifies and zeroes only work.files and work.mm,
which are never taken for poll add.
note: io_kiocb is exactly 4 cachelines now.

Signed-off-by: Pavel Begunkov <[email protected]>
---
 fs/io_uring.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 32b0064f806e..58e6f7d938b6 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -669,12 +669,12 @@ struct io_kiocb {
 		 * restore the work, if needed.
 		 */
 		struct {
-			struct callback_head	task_work;
-			struct hlist_node	hash_node;
 			struct async_poll	*apoll;
+			struct hlist_node	hash_node;
 		};
 		struct io_wq_work	work;
 	};
+	struct callback_head	task_work;
 };
 
 #define IO_PLUG_THRESHOLD		2
-- 
2.24.0


^ permalink raw reply related	[flat|nested] 10+ messages in thread

end of thread, other threads:[~2020-07-24 14:25 UTC | newest]

Thread overview: 10+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-07-23 18:12 [RFC][BUG] io_uring: fix work corruption for poll_add Pavel Begunkov
2020-07-23 18:15 ` Pavel Begunkov
2020-07-23 18:19   ` Jens Axboe
2020-07-23 19:10     ` Pavel Begunkov
2020-07-23 22:16 ` Jens Axboe
2020-07-23 22:24   ` Jens Axboe
2020-07-24 12:46     ` Pavel Begunkov
2020-07-24 12:52       ` Pavel Begunkov
2020-07-24 14:12         ` Jens Axboe
2020-07-24 14:23           ` Pavel Begunkov

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox