Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <d0f3cc26-959a-4e63-a840-5c3429932185@kernel.dk>
Date:   Fri, 20 Jan 2023 08:38:54 -0700
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux aarch64; rv:102.0) Gecko/20100101
 Thunderbird/102.6.0
Subject: Re: [PATCH] io_uring: Enable KASAN for request cache
Content-Language: en-US
To:     Pavel Begunkov <asml.silence@gmail.com>,
        Breno Leitao <leitao@debian.org>, io-uring@vger.kernel.org
Cc:     kasan-dev@googlegroups.com, leit@fb.com,
        linux-kernel@vger.kernel.org
References: <20230118155630.2762921-1-leitao@debian.org>
 <a0f75aa2-34dc-e3a8-c9fe-11f88412ef93@gmail.com>
From:   Jens Axboe <axboe@kernel.dk>
In-Reply-To: <a0f75aa2-34dc-e3a8-c9fe-11f88412ef93@gmail.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Precedence: bulk

On 1/20/23 8:09 AM, Pavel Begunkov wrote:
> On 1/18/23 15:56, Breno Leitao wrote:
>> Every io_uring request is represented by struct io_kiocb, which is
>> cached locally by io_uring (not SLAB/SLUB) in the list called
>> submit_state.freelist. This patch simply enabled KASAN for this free
>> list.
>>
>> This list is initially created by KMEM_CACHE, but later, managed by
>> io_uring. This patch basically poisons the objects that are not used
>> (i.e., they are the free list), and unpoisons it when the object is
>> allocated/removed from the list.
>>
>> Touching these poisoned objects while in the freelist will cause a KASAN
>> warning.
> 
> Doesn't apply cleanly to for-6.3/io_uring, but otherwise looks good
> 
> Reviewed-by: Pavel Begunkov <asml.silence@gmail.com>

I ran testing on this yesterday and noticed the same thing, just a
trivial fuzz reject. I can fix it up while applying. Thanks for
reviewing!

-- 
Jens Axboe