linux-kernel - [PATCH] io_uring: annotate sqd->thread access with data race in cancel path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250111105920.38083-1-minhquangbui99@gmail.com>
Date: Sat, 11 Jan 2025 17:59:19 +0700
From: Bui Quang Minh <minhquangbui99@...il.com>
To: linux-kernel@...r.kernel.org
Cc: Bui Quang Minh <minhquangbui99@...il.com>,
	Jens Axboe <axboe@...nel.dk>,
	Pavel Begunkov <asml.silence@...il.com>,
	io-uring@...r.kernel.org,
	syzbot+3c750be01dab672c513d@...kaller.appspotmail.com,
	Li Zetao <lizetao1@...wei.com>
Subject: [PATCH] io_uring: annotate sqd->thread access with data race in cancel path

The sqd->thread access in io_uring_cancel_generic is just for debug check
so we can safely ignore the data race.

The sqd->thread access in io_uring_try_cancel_requests is to check if the
caller is the sq threadi with the check ctx->sq_data->thread == current. In
case this is called in a task other than the sq thread, we expect the
expression to be false. And in that case, the sq_data->thread read can race
with the NULL write in the sq thread termination. However, the race will
still make ctx->sq_data->thread == current be false, so we can safely
ignore the data race.

Reported-by: syzbot+3c750be01dab672c513d@...kaller.appspotmail.com
Reported-by: Li Zetao <lizetao1@...wei.com>
Signed-off-by: Bui Quang Minh <minhquangbui99@...il.com>
---
 io_uring/io_uring.c | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index ff691f37462c..b1a116620ae1 100644
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -3094,9 +3094,18 @@ static __cold bool io_uring_try_cancel_requests(struct io_ring_ctx *ctx,
 		ret |= (cret != IO_WQ_CANCEL_NOTFOUND);
 	}
 
-	/* SQPOLL thread does its own polling */
+	/*
+	 * SQPOLL thread does its own polling
+	 *
+	 * We expect ctx->sq_data->thread == current to be false when
+	 * this function is called on a task other than the sq thread.
+	 * In that case, the sq_data->thread read can race with the
+	 * NULL write in the sq thread termination. However, the race
+	 * will still make ctx->sq_data->thread == current be false,
+	 * so we can safely ignore the data race here.
+	 */
 	if ((!(ctx->flags & IORING_SETUP_SQPOLL) && cancel_all) ||
-	    (ctx->sq_data && ctx->sq_data->thread == current)) {
+	    (ctx->sq_data && data_race(ctx->sq_data->thread) == current)) {
 		while (!wq_list_empty(&ctx->iopoll_list)) {
 			io_iopoll_try_reap_events(ctx);
 			ret = true;
@@ -3142,7 +3151,7 @@ __cold void io_uring_cancel_generic(bool cancel_all, struct io_sq_data *sqd)
 	s64 inflight;
 	DEFINE_WAIT(wait);
 
-	WARN_ON_ONCE(sqd && sqd->thread != current);
+	WARN_ON_ONCE(sqd && data_race(sqd->thread) != current);
 
 	if (!current->io_uring)
 		return;
-- 
2.43.0