Drain requests all go through io_drain_req, which has a quick exit in case
there is nothing pending (ie the drain is not useful). In that case it can
run the issue the request immediately.
However for safety it queues it through task work.
The problem is that in this case the request is run asynchronously, but
the async work has not been prepared through io_req_prep_async.
This has not been a problem up to now, as the task work always would run
before returning to userspace, and so the user would not have a chance to
race with it.
However - with IORING_SETUP_DEFER_TASKRUN - this is no longer the case and
the work might be defered, giving userspace a chance to change data being
referred to in the request.
Instead _always_ prep_async for drain requests, which is simpler anyway
and removes this issue.
Cc: stable(a)vger.kernel.org
Fixes: c0e0d6ba25f1 ("io_uring: add IORING_SETUP_DEFER_TASKRUN")
Signed-off-by: Dylan Yudaken <dylany(a)meta.com>
---
Hi,
Worth pointing out in discussion with Pavel that we considered just
removing the fast path in io_drain_req. That felt like more of an invasive
change as it can add an extra kmalloc + io_prep_async_link(), but perhaps
you feel that is a better approach.
I'll send out a liburing test shortly.
Dylan
io_uring/io_uring.c | 18 ++++++++----------
1 file changed, 8 insertions(+), 10 deletions(-)
diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index 0a4efada9b3c..db623b3185c8 100644
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -1765,17 +1765,12 @@ static __cold void io_drain_req(struct io_kiocb *req)
}
spin_unlock(&ctx->completion_lock);
- ret = io_req_prep_async(req);
- if (ret) {
-fail:
- io_req_defer_failed(req, ret);
- return;
- }
io_prep_async_link(req);
de = kmalloc(sizeof(*de), GFP_KERNEL);
if (!de) {
ret = -ENOMEM;
- goto fail;
+ io_req_defer_failed(req, ret);
+ return;
}
spin_lock(&ctx->completion_lock);
@@ -2048,13 +2043,16 @@ static void io_queue_sqe_fallback(struct io_kiocb *req)
req->flags &= ~REQ_F_HARDLINK;
req->flags |= REQ_F_LINK;
io_req_defer_failed(req, req->cqe.res);
- } else if (unlikely(req->ctx->drain_active)) {
- io_drain_req(req);
} else {
int ret = io_req_prep_async(req);
- if (unlikely(ret))
+ if (unlikely(ret)) {
io_req_defer_failed(req, ret);
+ return;
+ }
+
+ if (unlikely(req->ctx->drain_active))
+ io_drain_req(req);
else
io_queue_iowq(req, NULL);
}
base-commit: b00c51ef8f72ced0965d021a291b98ff822c5337
--
2.30.2
Build ID on arm64 is broken if CONFIG_MODVERSIONS=y
on 5.4, 5.10, and 5.15
Discussed:
https://lore.kernel.org/all/3df32572ec7016e783d37e185f88495831671f5d.167114…https://lore.kernel.org/all/cover.1670358255.git.tom.saeger@oracle.com/
Which is fixed for arm64 with backporting:
[2/6] ("arch: fix broken BuildID for arm64 and riscv")
Which had fixes:
[3/6] powerpc/vmlinux.lds: Define RUNTIME_DISCARD_EXIT
[4/6] powerpc/vmlinux.lds: Don't discard .rela* for relocatable builds
[5/6] s390: define RUNTIME_DISCARD_EXIT to fix link error with GNU ld < 2.36
But broke arch/sh (or so it was thought).
arch/sh is also broken in mainline.
[6/6] sh: define RUNTIME_DISCARD_EXIT
*NOTE* is not in mainline, but was sent here:
https://lore.kernel.org/all/9166a8abdc0f979e50377e61780a4bba1dfa2f52.167451…
There was enough breakage in 5.4.230-rc1 that the previous series was
dropped (which didn't have 1/6 or 6/6).
https://lore.kernel.org/stable/CA+G9fYuYi1Rvv19R_EVdht_7LV9qiR-6KVvZUGjct3k…
[1/6] 84d5f77fc2ee ("x86, vmlinux.lds: Add RUNTIME_DISCARD_EXIT to generic DISCARDS")
First defined RUNTIME_DISCARD_EXIT generically and its use for x86_64
specifically.
$ git describe --contains 84d5f77fc2ee4e0
v5.7-rc1~164^2~1
Which explains why the previous series broke 5.4.
I've build tested on a fairly wide matrix so far, but would appreciate
more testing.
with and without CONFIG_MODVERSIONS=y
# view Build ID
$ readelf -n vmlinux | grep "Build ID"
5.10 and 5.15 will have a similar series [2-6], as both already have [1/6].
If arch/sh is a must have, then [6/6] needs to find its way into mainline.
Regards,
--Tom
H.J. Lu (1):
x86, vmlinux.lds: Add RUNTIME_DISCARD_EXIT to generic DISCARDS
Masahiro Yamada (2):
arch: fix broken BuildID for arm64 and riscv
s390: define RUNTIME_DISCARD_EXIT to fix link error with GNU ld < 2.36
Michael Ellerman (2):
powerpc/vmlinux.lds: Define RUNTIME_DISCARD_EXIT
powerpc/vmlinux.lds: Don't discard .rela* for relocatable builds
Tom Saeger (1):
sh: define RUNTIME_DISCARD_EXIT
arch/powerpc/kernel/vmlinux.lds.S | 6 +++++-
arch/s390/kernel/vmlinux.lds.S | 2 ++
arch/sh/kernel/vmlinux.lds.S | 1 +
arch/x86/kernel/vmlinux.lds.S | 1 +
include/asm-generic/vmlinux.lds.h | 16 ++++++++++++++--
5 files changed, 23 insertions(+), 3 deletions(-)
base-commit: 90245959a5b936ee013266e5d1e6a508ed69274e
--
2.39.1