Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: Re: [BUG] About "io_uring: add more uring info to fdinfo for debug"
To:     Eric Dumazet <eric.dumazet@gmail.com>,
        Hao Xu <haoxu@linux.alibaba.com>
Cc:     LKML <linux-kernel@vger.kernel.org>,
        Eric Dumazet <edumazet@google.com>
References: <9ac22d4d-c841-651a-fdd5-9fb3a65c57ab@gmail.com>
From:   Jens Axboe <axboe@kernel.dk>
Message-ID: <e72cdd44-c027-e51c-8b57-24f39bf21d87@kernel.dk>
Date:   Thu, 28 Oct 2021 15:40:09 -0600
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
 Thunderbird/68.10.0
MIME-Version: 1.0
In-Reply-To: <9ac22d4d-c841-651a-fdd5-9fb3a65c57ab@gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 10/28/21 3:24 PM, Eric Dumazet wrote:
> Hi
> 
> I was looking at commit 83f84356bc8f2d
> ("io_uring: add more uring info to fdinfo for debug") after receiving
> syzbot reports.
> 
> I suspect that the following :
> 
> +       for (i = cached_sq_head; i < sq_tail; i++) {
> +               unsigned int sq_idx = READ_ONCE(ctx->sq_array[i & sq_mask]);
> +
> +               if (likely(sq_idx <= sq_mask)) {
> +                       struct io_uring_sqe *sqe = &ctx->sq_sqes[sq_idx];
> +
> +                       seq_printf(m, "%5u: opcode:%d, fd:%d, flags:%x, user_data:%llu\n",
> +                                  sq_idx, sqe->opcode, sqe->fd, sqe->flags, sqe->user_data);
> +               }
> +       }
> 
> 
> Can loop around ~2^32 times if sq_tail is close to ~0U
> 
> I see various READ_ONCE(), which are probably not good enough.
> 
> At very minimum I would handling wrapping...

Thanks for reporting this. I think on top of wrapping, the loop should
just be capped at sq_entries as well. There's no point dumping more than
that, ever.

I'll take a stab at this.

-- 
Jens Axboe