lkml.org 
[lkml]   [2020]   [Dec]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 516/717] io_uring: fix io_wqe->work_list corruption
    Date
    From: Xiaoguang Wang <xiaoguang.wang@linux.alibaba.com>

    commit 0020ef04e48571a88d4f482ad08f71052c5c5a08 upstream.

    For the first time a req punted to io-wq, we'll initialize io_wq_work's
    list to be NULL, then insert req to io_wqe->work_list. If this req is not
    inserted into tail of io_wqe->work_list, this req's io_wq_work list will
    point to another req's io_wq_work. For splitted bio case, this req maybe
    inserted to io_wqe->work_list repeatedly, once we insert it to tail of
    io_wqe->work_list for the second time, now io_wq_work->list->next will be
    invalid pointer, which then result in many strang error, panic, kernel
    soft-lockup, rcu stall, etc.

    In my vm, kernel doest not have commit cc29e1bf0d63f7 ("block: disable
    iopoll for split bio"), below fio job can reproduce this bug steadily:
    [global]
    name=iouring-sqpoll-iopoll-1
    ioengine=io_uring
    iodepth=128
    numjobs=1
    thread
    rw=randread
    direct=1
    registerfiles=1
    hipri=1
    bs=4m
    size=100M
    runtime=120
    time_based
    group_reporting
    randrepeat=0

    [device]
    directory=/home/feiman.wxg/mntpoint/ # an ext4 mount point

    If we have commit cc29e1bf0d63f7 ("block: disable iopoll for split bio"),
    there will no splitted bio case for polled io, but I think we still to need
    to fix this list corruption, it also should maybe go to stable branchs.

    To fix this corruption, if a req is inserted into tail of io_wqe->work_list,
    initialize req->io_wq_work->list->next to bu NULL.

    Cc: stable@vger.kernel.org
    Signed-off-by: Xiaoguang Wang <xiaoguang.wang@linux.alibaba.com>
    Reviewed-by: Pavel Begunkov <asml.silence@gmail.com>
    Signed-off-by: Jens Axboe <axboe@kernel.dk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    fs/io-wq.h | 1 +
    1 file changed, 1 insertion(+)

    --- a/fs/io-wq.h
    +++ b/fs/io-wq.h
    @@ -59,6 +59,7 @@ static inline void wq_list_add_tail(stru
    list->last->next = node;
    list->last = node;
    }
    + node->next = NULL;
    }

    static inline void wq_list_cut(struct io_wq_work_list *list,

    \
     
     \ /
      Last update: 2020-12-28 15:25    [W:4.018 / U:0.256 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site