linux-kernel - Re: [PATCH 1/1] io_uring: fix lazy work init

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1d7ac6e0-a14c-a102-ad33-a3b2b1e160d4@gmail.com>
Date:   Mon, 15 Jun 2020 16:59:44 +0300
From:   Pavel Begunkov <asml.silence@...il.com>
To:     Jens Axboe <axboe@...nel.dk>, io-uring@...r.kernel.org,
        linux-kernel@...r.kernel.org
Cc:     jiufei.xue@...ux.alibaba.com,
        Xiaoguang Wang <xiaoguang.wang@...ux.alibaba.com>
Subject: Re: [PATCH 1/1] io_uring: fix lazy work init

On 15/06/2020 16:36, Pavel Begunkov wrote:
> Don't leave garbage in req.work before punting async on -EAGAIN
> in io_iopoll_queue().

oops, cc'ed a wrong person.
+Cc: Xiaoguang Wang

> 
> [  140.922099] general protection fault, probably for non-canonical
>      address 0xdead000000000100: 0000 [#1] PREEMPT SMP PTI
> ...
> [  140.922105] RIP: 0010:io_worker_handle_work+0x1db/0x480
> ...
> [  140.922114] Call Trace:
> [  140.922118]  ? __next_timer_interrupt+0xe0/0xe0
> [  140.922119]  io_wqe_worker+0x2a9/0x360
> [  140.922121]  ? _raw_spin_unlock_irqrestore+0x24/0x40
> [  140.922124]  kthread+0x12c/0x170
> [  140.922125]  ? io_worker_handle_work+0x480/0x480
> [  140.922126]  ? kthread_park+0x90/0x90
> [  140.922127]  ret_from_fork+0x22/0x30
> 
> Fixes: 7cdaf587de7c ("io_uring: avoid whole io_wq_work copy for requests
> completed inline")
> Signed-off-by: Pavel Begunkov <asml.silence@...il.com>
> ---
>  fs/io_uring.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/fs/io_uring.c b/fs/io_uring.c
> index 54addaba742d..410b2df16c71 100644
> --- a/fs/io_uring.c
> +++ b/fs/io_uring.c
> @@ -1105,6 +1105,7 @@ static inline void io_prep_async_work(struct io_kiocb *req,
>  			req->work.flags |= IO_WQ_WORK_UNBOUND;
>  	}
>  
> +	io_req_init_async(req);
>  	io_req_work_grab_env(req, def);
>  
>  	*link = io_prep_linked_timeout(req);
> 

-- 
Pavel Begunkov