public inbox for [email protected]
 help / color / mirror / Atom feed
From: Pavel Begunkov <[email protected]>
To: Jens Axboe <[email protected]>, [email protected]
Subject: [RFC][BUG] io_uring: fix work corruption for poll_add
Date: Thu, 23 Jul 2020 21:12:30 +0300	[thread overview]
Message-ID: <eaa5b0f65c739072b3f0c9165ff4f9110ae399c4.1595527863.git.asml.silence@gmail.com> (raw)

poll_add can have req->work initialised, which will be overwritten in
__io_arm_poll_handler() because of the union. Luckily, hash_node is
zeroed in the end, so the damage is limited to lost put for work.creds,
and probably corrupted work.list.

That's the easiest and really dirty fix, which rearranges members in the
union, arm_poll*() modifies and zeroes only work.files and work.mm,
which are never taken for poll add.
note: io_kiocb is exactly 4 cachelines now.

Signed-off-by: Pavel Begunkov <[email protected]>
---
 fs/io_uring.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 32b0064f806e..58e6f7d938b6 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -669,12 +669,12 @@ struct io_kiocb {
 		 * restore the work, if needed.
 		 */
 		struct {
-			struct callback_head	task_work;
-			struct hlist_node	hash_node;
 			struct async_poll	*apoll;
+			struct hlist_node	hash_node;
 		};
 		struct io_wq_work	work;
 	};
+	struct callback_head	task_work;
 };
 
 #define IO_PLUG_THRESHOLD		2
-- 
2.24.0


             reply	other threads:[~2020-07-23 18:14 UTC|newest]

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-07-23 18:12 Pavel Begunkov [this message]
2020-07-23 18:15 ` [RFC][BUG] io_uring: fix work corruption for poll_add Pavel Begunkov
2020-07-23 18:19   ` Jens Axboe
2020-07-23 19:10     ` Pavel Begunkov
2020-07-23 22:16 ` Jens Axboe
2020-07-23 22:24   ` Jens Axboe
2020-07-24 12:46     ` Pavel Begunkov
2020-07-24 12:52       ` Pavel Begunkov
2020-07-24 14:12         ` Jens Axboe
2020-07-24 14:23           ` Pavel Begunkov

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=eaa5b0f65c739072b3f0c9165ff4f9110ae399c4.1595527863.git.asml.silence@gmail.com \
    [email protected] \
    [email protected] \
    [email protected] \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox