Commit 92a96b0a authored by Pavel Begunkov's avatar Pavel Begunkov Committed by Jens Axboe
Browse files

io_uring: add request poisoning 



Poison various request fields on free. __io_req_caches_free() is a slow
path, so can be done unconditionally, but gate it on kasan for
io_req_add_to_cache(). Note that some fields are logically retained
between cache allocations and can't be poisoned in
io_req_add_to_cache().

Ideally, it'd be replaced with KASAN'ed caches, but that can't be
enabled because of some synchronisation nuances.

Signed-off-by: default avatarPavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/7a78e8a7f5be434313c400650b862e36c211b312.1755459452.git.asml.silence@gmail.com


Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 1b237f19

include/linux/poison.h

+3 −0
Original line number Diff line number Diff line
@@ -90,4 +90,7 @@ 
/********** lib/stackdepot.c **********/

#define STACK_DEPOT_POISON ((void *)(0xD390 + POISON_POINTER_DELTA))



/********** io_uring/ **********/

#define IO_URING_PTR_POISON ((void *)(0x1091UL + POISON_POINTER_DELTA))



#endif

io_uring/io_uring.c

+23 −0
Original line number Diff line number Diff line
@@ -179,6 +179,26 @@ static const struct ctl_table kernel_io_uring_disabled_table[] = { 
};

#endif



static void io_poison_cached_req(struct io_kiocb *req)

{

	req->ctx = IO_URING_PTR_POISON;

	req->tctx = IO_URING_PTR_POISON;

	req->file = IO_URING_PTR_POISON;

	req->creds = IO_URING_PTR_POISON;

	req->io_task_work.func = IO_URING_PTR_POISON;

	req->apoll = IO_URING_PTR_POISON;

}



static void io_poison_req(struct io_kiocb *req)

{

	io_poison_cached_req(req);

	req->async_data = IO_URING_PTR_POISON;

	req->kbuf = IO_URING_PTR_POISON;

	req->comp_list.next = IO_URING_PTR_POISON;

	req->file_node = IO_URING_PTR_POISON;

	req->link = IO_URING_PTR_POISON;

}



static inline unsigned int __io_cqring_events(struct io_ring_ctx *ctx)

{

	return ctx->cached_cq_tail - READ_ONCE(ctx->rings->cq.head);
@@ -235,6 +255,8 @@ static inline void req_fail_link_node(struct io_kiocb *req, int res) 


static inline void io_req_add_to_cache(struct io_kiocb *req, struct io_ring_ctx *ctx)

{

	if (IS_ENABLED(CONFIG_KASAN))

		io_poison_cached_req(req);

	wq_stack_add_head(&req->comp_list, &ctx->submit_state.free_list);

}
@@ -2767,6 +2789,7 @@ static __cold void __io_req_caches_free(struct io_ring_ctx *ctx) 


	while (!io_req_cache_empty(ctx)) {

		req = io_extract_req(ctx);

		io_poison_req(req);

		kmem_cache_free(req_cachep, req);

		nr++;

	}