Messages in this thread | | | From | Pavel Begunkov <> | Subject | [BUG] io_uring: defer logic based on shared data | Date | Fri, 25 Oct 2019 12:55:25 +0300 |
| |
I found 2 problems with __io_sequence_defer().
1. it uses @sq_dropped, but doesn't consider @cq_overflow 2. @sq_dropped and @cq_overflow are write-shared with userspace, so it can be maliciously changed.
see sent liburing test (test/defer *_hung()), which left an unkillable process for me
-- Yours sincerely, Pavel Begunkov
[unhandled content-type:application/pgp-signature] | |