| Message ID | c7350d07fefe8cce32b50f57665edbb6355ea8c1.1719927398.git.asml.silence@gmail.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | [1/1] io_uring/msg_ring: fix overflow posting | expand |
On 7/2/24 14:38, Pavel Begunkov wrote: > The caller of io_cqring_event_overflow() should be holding the > completion_lock, which is violated by io_msg_tw_complete. There > is only one caller of io_add_aux_cqe(), so just add locking there > for now. Seems like it can be squashed into the blamed patch and it's still somewhat on top. note: msg-ring-overflow.t reproduces it well.
On Tue, 02 Jul 2024 14:38:11 +0100, Pavel Begunkov wrote: > The caller of io_cqring_event_overflow() should be holding the > completion_lock, which is violated by io_msg_tw_complete. There > is only one caller of io_add_aux_cqe(), so just add locking there > for now. > > WARNING: CPU: 0 PID: 5145 at io_uring/io_uring.c:703 io_cqring_event_overflow+0x442/0x660 io_uring/io_uring.c:703 > RIP: 0010:io_cqring_event_overflow+0x442/0x660 io_uring/io_uring.c:703 > <TASK> > __io_post_aux_cqe io_uring/io_uring.c:816 [inline] > io_add_aux_cqe+0x27c/0x320 io_uring/io_uring.c:837 > io_msg_tw_complete+0x9d/0x4d0 io_uring/msg_ring.c:78 > io_fallback_req_func+0xce/0x1c0 io_uring/io_uring.c:256 > process_one_work kernel/workqueue.c:3224 [inline] > process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3305 > worker_thread+0x86d/0xd40 kernel/workqueue.c:3383 > kthread+0x2f0/0x390 kernel/kthread.c:389 > ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:144 > ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 > </TASK> > > [...] Applied, thanks! [1/1] io_uring/msg_ring: fix overflow posting commit: 3b7c16be30e35ec035b2efcc0f7d7b368789c443 Best regards,
diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c index 7ed1e009aaec..42139bb85fff 100644 --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -834,7 +834,11 @@ bool io_post_aux_cqe(struct io_ring_ctx *ctx, u64 user_data, s32 res, u32 cflags */ void io_add_aux_cqe(struct io_ring_ctx *ctx, u64 user_data, s32 res, u32 cflags) { - __io_post_aux_cqe(ctx, user_data, res, cflags); + if (!io_fill_cqe_aux(ctx, user_data, res, cflags)) { + spin_lock(&ctx->completion_lock); + io_cqring_event_overflow(ctx, user_data, res, cflags, 0, 0); + spin_unlock(&ctx->completion_lock); + } ctx->submit_state.cq_flush = true; }
The caller of io_cqring_event_overflow() should be holding the completion_lock, which is violated by io_msg_tw_complete. There is only one caller of io_add_aux_cqe(), so just add locking there for now. WARNING: CPU: 0 PID: 5145 at io_uring/io_uring.c:703 io_cqring_event_overflow+0x442/0x660 io_uring/io_uring.c:703 RIP: 0010:io_cqring_event_overflow+0x442/0x660 io_uring/io_uring.c:703 <TASK> __io_post_aux_cqe io_uring/io_uring.c:816 [inline] io_add_aux_cqe+0x27c/0x320 io_uring/io_uring.c:837 io_msg_tw_complete+0x9d/0x4d0 io_uring/msg_ring.c:78 io_fallback_req_func+0xce/0x1c0 io_uring/io_uring.c:256 process_one_work kernel/workqueue.c:3224 [inline] process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3305 worker_thread+0x86d/0xd40 kernel/workqueue.c:3383 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:144 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Fixes: f33096a3c99c0 ("io_uring: add io_add_aux_cqe() helper") Reported-by: syzbot+f7f9c893345c5c615d34@syzkaller.appspotmail.com Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> --- io_uring/io_uring.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)