linux-kernel - [PATCH v7 0/3] io_uring: use release-acquire ordering for IORING_SETUP_R

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20260105210543.3471082-1-csander@purestorage.com>
Date: Mon,  5 Jan 2026 14:05:39 -0700
From: Caleb Sander Mateos <csander@...estorage.com>
To: Jens Axboe <axboe@...nel.dk>
Cc: Joanne Koong <joannelkoong@...il.com>,
	io-uring@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	Caleb Sander Mateos <csander@...estorage.com>
Subject: [PATCH v7 0/3] io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED

io_uring_enter(), __io_msg_ring_data(), and io_msg_send_fd() read
ctx->flags and ctx->submitter_task without holding the ctx's uring_lock.
This means they may race with the assignment to ctx->submitter_task and
the clearing of IORING_SETUP_R_DISABLED from ctx->flags in
io_register_enable_rings(). Ensure the correct ordering of the
ctx->flags and ctx->submitter_task memory accesses by storing to
ctx->flags using release ordering and loading it using acquire ordering.

Using release-acquire ordering for IORING_SETUP_R_DISABLED ensures the
assignment to ctx->submitter_task in io_register_enable_rings() can't
race with msg_ring's accesses, so drop the unneeded {READ,WRITE}_ONCE()
and the NULL checks.

v7:
- Split from IORING_SETUP_SINGLE_ISSUER optimization series
- Drop unnecessary submitter_task {READ,WRITE}_ONCE() and NULL checks
- Drop redundant submitter_task check in io_register_enable_rings()
- Add comments explaining need for release-acquire ordering

Caleb Sander Mateos (3):
  io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED
  io_uring/msg_ring: drop unnecessary submitter_task checks
  io_uring/register: drop io_register_enable_rings() submitter_task
    check

 io_uring/io_uring.c | 13 ++++++-------
 io_uring/msg_ring.c | 28 ++++++++++++++--------------
 io_uring/register.c |  7 ++++---
 3 files changed, 24 insertions(+), 24 deletions(-)

-- 
2.45.2