lkml.org 
[lkml]   [2020]   [Aug]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 5.7 07/60] io_uring: fix req->work corruption
    Date
    From: Pavel Begunkov <asml.silence@gmail.com>

    [ Upstream commit 8ef77766ba8694968ed4ba24311b4bacee14f235 ]

    req->work and req->task_work are in a union, so io_req_task_queue() screws
    everything that was in work. De-union them for now.

    [ 704.367253] BUG: unable to handle page fault for address:
    ffffffffaf7330d0
    [ 704.367256] #PF: supervisor write access in kernel mode
    [ 704.367256] #PF: error_code(0x0003) - permissions violation
    [ 704.367261] CPU: 6 PID: 1654 Comm: io_wqe_worker-0 Tainted: G
    I 5.8.0-rc2-00038-ge28d0bdc4863-dirty #498
    [ 704.367265] RIP: 0010:_raw_spin_lock+0x1e/0x36
    ...
    [ 704.367276] __alloc_fd+0x35/0x150
    [ 704.367279] __get_unused_fd_flags+0x25/0x30
    [ 704.367280] io_openat2+0xcb/0x1b0
    [ 704.367283] io_issue_sqe+0x36a/0x1320
    [ 704.367294] io_wq_submit_work+0x58/0x160
    [ 704.367295] io_worker_handle_work+0x2a3/0x430
    [ 704.367296] io_wqe_worker+0x2a0/0x350
    [ 704.367301] kthread+0x136/0x180
    [ 704.367304] ret_from_fork+0x22/0x30

    Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
    Signed-off-by: Jens Axboe <axboe@kernel.dk>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    fs/io_uring.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/fs/io_uring.c b/fs/io_uring.c
    index 4e09af1d5d223..80a612d1e12bb 100644
    --- a/fs/io_uring.c
    +++ b/fs/io_uring.c
    @@ -645,12 +645,12 @@ struct io_kiocb {
    * restore the work, if needed.
    */
    struct {
    - struct callback_head task_work;
    struct hlist_node hash_node;
    struct async_poll *apoll;
    };
    struct io_wq_work work;
    };
    + struct callback_head task_work;
    };

    #define IO_PLUG_THRESHOLD 2
    --
    2.25.1
    \
     
     \ /
      Last update: 2020-08-10 21:30    [W:4.117 / U:0.332 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site