linux-kernel - Re: [PATCH] io_uring: simplify the SQPOLL thread check when cancelling requests

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <fe804e02-f791-4885-94b7-ffdf2476573b@gmail.com>
Date: Mon, 13 Jan 2025 22:33:15 +0700
From: Bui Quang Minh <minhquangbui99@...il.com>
To: Pavel Begunkov <asml.silence@...il.com>, lizetao <lizetao1@...wei.com>,
 "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Cc: Jens Axboe <axboe@...nel.dk>,
 "io-uring@...r.kernel.org" <io-uring@...r.kernel.org>,
 "syzbot+3c750be01dab672c513d@...kaller.appspotmail.com"
 <syzbot+3c750be01dab672c513d@...kaller.appspotmail.com>
Subject: Re: [PATCH] io_uring: simplify the SQPOLL thread check when
 cancelling requests

On 1/13/25 04:15, Pavel Begunkov wrote:
> On 1/12/25 16:14, Bui Quang Minh wrote:
> ...
>>>> @@ -2898,7 +2899,12 @@ static __cold void io_ring_exit_work(struct
>>>> work_struct *work)
>>>>           if (ctx->flags & IORING_SETUP_DEFER_TASKRUN)
>>>>               io_move_task_work_from_local(ctx);
>>>>
>>>> -        while (io_uring_try_cancel_requests(ctx, NULL, true))
>>>> +        /*
>>>> +         * Even if SQPOLL thread reaches this path, don't force
>>>> +         * iopoll here, let the io_uring_cancel_generic handle
>>>> +         * it.
>>>
>>> Just curious, will sq_thread enter this io_ring_exit_work path?
>>
>> AFAIK, yes. The SQPOLL thread is created with create_io_thread, this 
>> function creates a new task with CLONE_FILES. So all the open files is 
>> shared. There will be case that the parent closes its io_uring file 
>> and SQPOLL thread become the only owner of that file. So it can reach 
>> this path when terminating.
> 
> The function is run by a separate kthread, the sqpoll task doesn't
> call it directly.

Yeah, the io_uring_release can be called in sqpoll thread but the 
io_ring_exit_work is queued in the io_uring workqueue so that function 
is executed in a kthread worker.

I will update the comment and commit message.

Thanks,
Quang Minh.