2020-04-09 05:21:09

by Pavel Begunkov

Subject: [PATCH] io_uring: fix fs cleanup on cqe overflow

If completion queue overflow happened, __io_cqring_fill_event() will
update req->cflags, which is in a union with req->work and happend to
be aliased to req->work.fs. Following io_free_req() ->
io_req_work_drop_env() may get a bunch of different problems (miscount
fs->users, segfault, etc) on cleaning @fs.

Signed-off-by: Pavel Begunkov <[email protected]>
---

P.S. never tried to reproduce the issue

fs/io_uring.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 21e1c69b9c43..be65eda059ac 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -608,6 +608,7 @@ struct io_kiocb {
};

struct io_async_ctx *io;
+ int cflags;
bool needs_fixed_file;
u8 opcode;

@@ -638,7 +639,6 @@ struct io_kiocb {
struct callback_head task_work;
struct hlist_node hash_node;
struct async_poll *apoll;
- int cflags;
};
struct io_wq_work work;
};
--
2.24.0

2020-04-09 15:39:25

by Jens Axboe

Subject: Re: [PATCH] io_uring: fix fs cleanup on cqe overflow

On 4/8/20 10:17 PM, Pavel Begunkov wrote:
> If completion queue overflow happened, __io_cqring_fill_event() will
> update req->cflags, which is in a union with req->work and happend to
> be aliased to req->work.fs. Following io_free_req() ->
> io_req_work_drop_env() may get a bunch of different problems (miscount
> fs->users, segfault, etc) on cleaning @fs.

Good catch, applied.

--
Jens Axboe