linux-kernel - Re: io-uring: KASAN failure, presumably

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 12 Sep 2021 11:21:55 -0700
From:   Nadav Amit <nadav.amit@...il.com>
To:     Jens Axboe <axboe@...nel.dk>
Cc:     Pavel Begunkov <asml.silence@...il.com>, io-uring@...r.kernel.org,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: io-uring: KASAN failure, presumably



> On Sep 12, 2021, at 11:15 AM, Jens Axboe <axboe@...nel.dk> wrote:
> 
> On 9/11/21 8:34 PM, Nadav Amit wrote:
>> Hello Jens (& Pavel),
>> 
>> I hope you are having a nice weekend. I ran into a KASAN failure in io-uring
>> which I think is not "my fault".
>> 
>> The failure does not happen very infrequently, so my analysis is based on
>> reading the code. IIUC the failure, then I do not understand the code well
>> enough, as to say I do not understand how it was supposed to work. I would
>> appreciate your feedback.
>> 
>> The failure happens on my own custom kernel (do not try to correlate the line
>> numbers). The gist of the splat is:
> 
> I think this is specific to your use case, but I also think that we
> should narrow the scope for this type of REQ_F_REISSUE trigger. It
> really should only happen on bdev backed regular files, where we cannot
> easily pass back congestion. For that case, the completion for this is
> called while we're in ->write_iter() for example, and hence there is no
> race here.
> 
> I'll ponder this a bit…

I see what you are saying. The assumption is that write_iter() is setting
REQ_F_REISSUE, which is not the case in my use-case. Perhaps EAGAIN is
anyhow not the right return value (in my case). I am not sure any other
“invalid" use-case exists, but some documentation/assertion(?) can help.

I changed the return error-codes and check that the issue is not
triggered again.

Thanks, as usual, for the quick response.