[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <5badf1c0-9a7d-0950-2943-ff8db33e0929@gmail.com>
Date: Fri, 25 Oct 2019 12:55:25 +0300
From: Pavel Begunkov <asml.silence@...il.com>
To: Jens Axboe <axboe@...nel.dk>, linux-block@...r.kernel.org,
linux-kernel@...r.kernel.org
Subject: [BUG] io_uring: defer logic based on shared data
I found 2 problems with __io_sequence_defer().
1. it uses @sq_dropped, but doesn't consider @cq_overflow
2. @sq_dropped and @cq_overflow are write-shared with userspace, so
it can be maliciously changed.
see sent liburing test (test/defer *_hung()), which left an unkillable
process for me
--
Yours sincerely,
Pavel Begunkov
Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists