linux-kernel - Re: [PATCH v3 0/4] forbid fix {SQ,IO}POLL

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Thu, 4 Jun 2020 23:25:36 +0300
From:   Pavel Begunkov <asml.silence@...il.com>
To:     Jens Axboe <axboe@...nel.dk>, io-uring@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH v3 0/4] forbid fix {SQ,IO}POLL

On 04/06/2020 23:17, Jens Axboe wrote:
> On 6/4/20 2:12 PM, Pavel Begunkov wrote:
>> On 04/06/2020 22:52, Jens Axboe wrote:
>>> On 6/4/20 1:22 PM, Pavel Begunkov wrote:
>>>> On 04/06/2020 20:06, Jens Axboe wrote:
>>>>> On 6/3/20 12:51 PM, Jens Axboe wrote:
>>>>>> On 6/3/20 9:03 AM, Pavel Begunkov wrote:
>>>>>>> The first one adds checks {SQPOLL,IOPOLL}. IOPOLL check can be
>>>>>>> moved in the common path later, or rethinked entirely, e.g.
>>>>>>> not io_iopoll_req_issued()'ed for unsupported opcodes.
>>>>>>>
>>>>>>> 3 others are just cleanups on top.
>>>>>>>
>>>>>>>
>>>>>>> v2: add IOPOLL to the whole bunch of opcodes in [1/4].
>>>>>>>     dirty and effective.
>>>>>>> v3: sent wrong set in v2, re-sending right one 
>>>>>>>
>>>>>>> Pavel Begunkov (4):
>>>>>>>   io_uring: fix {SQ,IO}POLL with unsupported opcodes
>>>>>>>   io_uring: do build_open_how() only once
>>>>>>>   io_uring: deduplicate io_openat{,2}_prep()
>>>>>>>   io_uring: move send/recv IOPOLL check into prep
>>>>>>>
>>>>>>>  fs/io_uring.c | 94 ++++++++++++++++++++++++++-------------------------
>>>>>>>  1 file changed, 48 insertions(+), 46 deletions(-)
>>>>>>
>>>>>> Thanks, applied.
>>>>>
>>>>> #1 goes too far, provide/remove buffers is fine with iopoll. I'll
>>>>> going to edit the patch.
>>>>
>>>> Conceptually it should work, but from a quick look:
>>>>
>>>> - io_provide_buffers() drops a ref from req->refs, which should've
>>>> been used by iopoll*. E.g. io_complete_rw_iopoll() doesn't do that.
>>>>
>>>> - it doesn't set REQ_F_IOPOLL_COMPLETED, thus iopoll* side will
>>>> call req->file->iopoll().
>>>
>>> We don't poll for provide/remove buffers, or file update. The
>>> completion is done inline. The REQ_F_IOPOLL_COMPLETED and friends
>>> is only applicable on read/writes.
>>>
>>
>> 1. Let io_provide_buffers() succeeds, putting a ref and returning 0
>>
>> 2. io_issue_sqe() on the way back do IORING_SETUP_IOPOLL check,
>> where it calls io_iopoll_req_issued(req)
> 
> Only if req->file is valid, which it isn't for these non-file requests.

Ok, it looks like I miss your commit doing ->file check there.
Now sure how it slipped even though it's marked v5.7-rc7.


>>
>> 3. io_iopoll_req_issued() unconditionally adds the req into ->poll_list
>>
>> 4. io_do_iopoll() checks the req, doesn't find it flagged with
>> REQ_F_IOPOLL_COMPLETED, and tries req->file->iopoll().
>>
>>
>> Do I miss something? Just did a quick and dirty test, which segfaulted.
>> Not certain about it though.
>>
> 
> 

-- 
Pavel Begunkov