linux-kernel - Re: [PATCH v2] io_uring: simplify the SQPOLL thread check when cancelling requests

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <a5910007-017c-4b80-b0ae-e36569c88b15@gmail.com>
Date: Mon, 13 Jan 2025 21:34:56 +0000
From: Pavel Begunkov <asml.silence@...il.com>
To: Bui Quang Minh <minhquangbui99@...il.com>, linux-kernel@...r.kernel.org
Cc: Jens Axboe <axboe@...nel.dk>, io-uring@...r.kernel.org,
 syzbot+3c750be01dab672c513d@...kaller.appspotmail.com,
 Li Zetao <lizetao1@...wei.com>
Subject: Re: [PATCH v2] io_uring: simplify the SQPOLL thread check when
 cancelling requests

On 1/13/25 16:03, Bui Quang Minh wrote:
> In io_uring_try_cancel_requests, we check whether sq_data->thread ==
> current to determine if the function is called by the SQPOLL thread to do
> iopoll when IORING_SETUP_SQPOLL is set. This check can race with the SQPOLL
> thread termination.
> 
> io_uring_cancel_generic is used in 2 places: io_uring_cancel_generic and
> io_ring_exit_work. In io_uring_cancel_generic, we have the information
> whether the current is SQPOLL thread already. And the SQPOLL thread never
> reaches io_ring_exit_work.
> 
> So to avoid the racy check, this commit adds a boolean flag to
> io_uring_try_cancel_requests to determine if the caller is SQPOLL thread.

I think the comment is excessive, but let's leave it at that if
you don't want to respin it.

Reviewed-by: Pavel Begunkov <asml.silence@...il.com>

-- 
Pavel Begunkov