public inbox for [email protected]
 help / color / mirror / Atom feed
* [PATCH 1/1] io_uring: Fix ->data corruption on re-enqueue
@ 2020-03-22 21:23 Pavel Begunkov
  2020-03-23  1:28 ` Jens Axboe
  2020-03-23  8:19 ` [PATCH v2] " Pavel Begunkov
  0 siblings, 2 replies; 4+ messages in thread
From: Pavel Begunkov @ 2020-03-22 21:23 UTC (permalink / raw)
  To: Jens Axboe, io-uring, linux-kernel

work->data and work->list are shared in union. io_wq_assign_next() sets
->data if a req having a linked_timeout, but then io-wq may want to use
work->list, e.g. to do re-enqueue of a request, so corrupting ->data.

->data is not necessary, just remove it and extract linked_timeout
through @link_list.

Signed-off-by: Pavel Begunkov <[email protected]>
---
 fs/io-wq.h    | 5 +----
 fs/io_uring.c | 9 ++++-----
 2 files changed, 5 insertions(+), 9 deletions(-)

diff --git a/fs/io-wq.h b/fs/io-wq.h
index 298b21f4a4d2..d2a5684bf673 100644
--- a/fs/io-wq.h
+++ b/fs/io-wq.h
@@ -63,10 +63,7 @@ static inline void wq_node_del(struct io_wq_work_list *list,
 } while (0)
 
 struct io_wq_work {
-	union {
-		struct io_wq_work_node list;
-		void *data;
-	};
+	struct io_wq_work_node list;
 	void (*func)(struct io_wq_work **);
 	struct files_struct *files;
 	struct mm_struct *mm;
diff --git a/fs/io_uring.c b/fs/io_uring.c
index 5267e331b4a4..ce8f38aa070a 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -1567,9 +1567,10 @@ static void io_free_req(struct io_kiocb *req)
 
 static void io_link_work_cb(struct io_wq_work **workptr)
 {
-	struct io_wq_work *work = *workptr;
-	struct io_kiocb *link = work->data;
+	struct io_kiocb *req = container_of(*workptr, struct io_kiocb, work);
+	struct io_kiocb *link;
 
+	link = list_first_entry(&req->link_list, struct io_kiocb, link_list);
 	io_queue_linked_timeout(link);
 	io_wq_submit_work(workptr);
 }
@@ -1584,10 +1585,8 @@ static void io_wq_assign_next(struct io_wq_work **workptr, struct io_kiocb *nxt)
 
 	*workptr = &nxt->work;
 	link = io_prep_linked_timeout(nxt);
-	if (link) {
+	if (link)
 		nxt->work.func = io_link_work_cb;
-		nxt->work.data = link;
-	}
 }
 
 /*
-- 
2.24.0


^ permalink raw reply related	[flat|nested] 4+ messages in thread

* Re: [PATCH 1/1] io_uring: Fix ->data corruption on re-enqueue
  2020-03-22 21:23 [PATCH 1/1] io_uring: Fix ->data corruption on re-enqueue Pavel Begunkov
@ 2020-03-23  1:28 ` Jens Axboe
  2020-03-23  8:19 ` [PATCH v2] " Pavel Begunkov
  1 sibling, 0 replies; 4+ messages in thread
From: Jens Axboe @ 2020-03-23  1:28 UTC (permalink / raw)
  To: Pavel Begunkov, io-uring, linux-kernel

On 3/22/20 3:23 PM, Pavel Begunkov wrote:
> work->data and work->list are shared in union. io_wq_assign_next() sets
> ->data if a req having a linked_timeout, but then io-wq may want to use
> work->list, e.g. to do re-enqueue of a request, so corrupting ->data.
> 
> ->data is not necessary, just remove it and extract linked_timeout
> through @link_list.

You're missing a Fixes line again!

-- 
Jens Axboe


^ permalink raw reply	[flat|nested] 4+ messages in thread

* [PATCH v2] io_uring: Fix ->data corruption on re-enqueue
  2020-03-22 21:23 [PATCH 1/1] io_uring: Fix ->data corruption on re-enqueue Pavel Begunkov
  2020-03-23  1:28 ` Jens Axboe
@ 2020-03-23  8:19 ` Pavel Begunkov
  2020-03-23 14:25   ` Jens Axboe
  1 sibling, 1 reply; 4+ messages in thread
From: Pavel Begunkov @ 2020-03-23  8:19 UTC (permalink / raw)
  To: Jens Axboe, io-uring, linux-kernel

work->data and work->list are shared in union. io_wq_assign_next() sets
->data if a req having a linked_timeout, but then io-wq may want to use
work->list, e.g. to do re-enqueue of a request, so corrupting ->data.

Don't need ->data, remove it and get linked_timeout through @link_list.

Fixes: 60cf46ae6054 ("io-wq: hash dependent work")
Signed-off-by: Pavel Begunkov <[email protected]>
---
 fs/io-wq.h    | 5 +----
 fs/io_uring.c | 9 ++++-----
 2 files changed, 5 insertions(+), 9 deletions(-)

diff --git a/fs/io-wq.h b/fs/io-wq.h
index 298b21f4a4d2..d2a5684bf673 100644
--- a/fs/io-wq.h
+++ b/fs/io-wq.h
@@ -63,10 +63,7 @@ static inline void wq_node_del(struct io_wq_work_list *list,
 } while (0)
 
 struct io_wq_work {
-	union {
-		struct io_wq_work_node list;
-		void *data;
-	};
+	struct io_wq_work_node list;
 	void (*func)(struct io_wq_work **);
 	struct files_struct *files;
 	struct mm_struct *mm;
diff --git a/fs/io_uring.c b/fs/io_uring.c
index 5267e331b4a4..ce8f38aa070a 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -1567,9 +1567,10 @@ static void io_free_req(struct io_kiocb *req)
 
 static void io_link_work_cb(struct io_wq_work **workptr)
 {
-	struct io_wq_work *work = *workptr;
-	struct io_kiocb *link = work->data;
+	struct io_kiocb *req = container_of(*workptr, struct io_kiocb, work);
+	struct io_kiocb *link;
 
+	link = list_first_entry(&req->link_list, struct io_kiocb, link_list);
 	io_queue_linked_timeout(link);
 	io_wq_submit_work(workptr);
 }
@@ -1584,10 +1585,8 @@ static void io_wq_assign_next(struct io_wq_work **workptr, struct io_kiocb *nxt)
 
 	*workptr = &nxt->work;
 	link = io_prep_linked_timeout(nxt);
-	if (link) {
+	if (link)
 		nxt->work.func = io_link_work_cb;
-		nxt->work.data = link;
-	}
 }
 
 /*
-- 
2.24.0


^ permalink raw reply related	[flat|nested] 4+ messages in thread

* Re: [PATCH v2] io_uring: Fix ->data corruption on re-enqueue
  2020-03-23  8:19 ` [PATCH v2] " Pavel Begunkov
@ 2020-03-23 14:25   ` Jens Axboe
  0 siblings, 0 replies; 4+ messages in thread
From: Jens Axboe @ 2020-03-23 14:25 UTC (permalink / raw)
  To: Pavel Begunkov, io-uring, linux-kernel

On 3/23/20 2:19 AM, Pavel Begunkov wrote:
> work->data and work->list are shared in union. io_wq_assign_next() sets
> ->data if a req having a linked_timeout, but then io-wq may want to use
> work->list, e.g. to do re-enqueue of a request, so corrupting ->data.
> 
> Don't need ->data, remove it and get linked_timeout through @link_list.

Thanks!

-- 
Jens Axboe


^ permalink raw reply	[flat|nested] 4+ messages in thread

end of thread, other threads:[~2020-03-23 14:25 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-03-22 21:23 [PATCH 1/1] io_uring: Fix ->data corruption on re-enqueue Pavel Begunkov
2020-03-23  1:28 ` Jens Axboe
2020-03-23  8:19 ` [PATCH v2] " Pavel Begunkov
2020-03-23 14:25   ` Jens Axboe

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox