| Message ID | 20240702-bug9-v1-1-475cb52d3ee6@gmail.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | io_uring: Fix WARNING in io_cqring_event_overflow | expand |
On 7/2/24 6:48 PM, Pei Li wrote: > Acquire ctx->completion_lock in io_add_aux_cqe(). > > syzbot reports a warning message in io_cqring_event_overflow(). We were > supposed to hold ctx->completion_lock before entering this function, but > instead we did not. > > This patch acquires and releases ctx->completion_lock when entering and > exiting io_add_aux_cqe(). Thanks for sending a patch, but Pavel already fixed it: https://git.kernel.dk/cgit/linux/commit/?h=for-6.11/io_uring&id=3b7c16be30e35ec035b2efcc0f7d7b368789c443
diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c index 4e2836c9b7bf..0f62332e95ff 100644 --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -834,8 +834,10 @@ bool io_post_aux_cqe(struct io_ring_ctx *ctx, u64 user_data, s32 res, u32 cflags */ void io_add_aux_cqe(struct io_ring_ctx *ctx, u64 user_data, s32 res, u32 cflags) { + io_cq_lock(ctx); __io_post_aux_cqe(ctx, user_data, res, cflags); ctx->submit_state.cq_flush = true; + io_cq_unlock_post(ctx); } /*
Acquire ctx->completion_lock in io_add_aux_cqe(). syzbot reports a warning message in io_cqring_event_overflow(). We were supposed to hold ctx->completion_lock before entering this function, but instead we did not. This patch acquires and releases ctx->completion_lock when entering and exiting io_add_aux_cqe(). Fixes: f33096a3c99c ("io_uring: add io_add_aux_cqe() helper") Reported-by: syzbot+f7f9c893345c5c615d34@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=f7f9c893345c5c615d34 Signed-off-by: Pei Li <peili.dev@gmail.com> --- syzbot reports a warning message in io_cqring_event_overflow(). We were supposed to hold ctx->completion_lock before entering this function, but instead we did not. The call stack is as follows: Call Trace: <TASK> __io_post_aux_cqe io_uring/io_uring.c:816 [inline] io_add_aux_cqe+0x27c/0x320 io_uring/io_uring.c:837 io_msg_tw_complete+0x9d/0x4d0 io_uring/msg_ring.c:78 io_fallback_req_func+0xce/0x1c0 io_uring/io_uring.c:256 process_one_work kernel/workqueue.c:3224 [inline] process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3305 worker_thread+0x86d/0xd40 kernel/workqueue.c:3383 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:144 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> In io_add_aux_cqe(), we should acquire this lock beforehead. This patch acquires and releases ctx->completion_lock when entering and exiting io_add_aux_cqe(). --- io_uring/io_uring.c | 2 ++ 1 file changed, 2 insertions(+) --- base-commit: 74564adfd3521d9e322cfc345fdc132df80f3c79 change-id: 20240702-bug9-ad8a36681e2d Best regards,