Commit f4a1254f authored by Pavel Begunkov's avatar Pavel Begunkov Committed by Jens Axboe
Browse files

io_uring: fix cancellation overwriting req->flags 



Only the current owner of a request is allowed to write into req->flags.
Hence, the cancellation path should never touch it. Add a new field
instead of the flag, move it into the 3rd cache line because it should
always be initialised. poll_refs can move further as polling is an
involved process anyway.

It's a minimal patch, in the future we can and should find a better
place for it and remove now unused REQ_F_CANCEL_SEQ.

Fixes: 521223d7 ("io_uring/cancel: don't default to setting req->work.cancel_seq")
Cc: stable@vger.kernel.org
Reported-by: default avatarLi Shi <sl1589472800@gmail.com>
Signed-off-by: default avatarPavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/6827b129f8f0ad76fa9d1f0a773de938b240ffab.1718323430.git.asml.silence@gmail.com


Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 54559642

include/linux/io_uring_types.h

+2 −1
Original line number Diff line number Diff line
@@ -648,7 +648,7 @@ struct io_kiocb { 
	struct io_rsrc_node		*rsrc_node;



	atomic_t			refs;

	atomic_t			poll_refs;

	bool				cancel_seq_set;

	struct io_task_work		io_task_work;

	/* for polled requests, i.e. IORING_OP_POLL_ADD and async armed poll */

	struct hlist_node		hash_node;
@@ -657,6 +657,7 @@ struct io_kiocb { 
	/* opcode allocated if it needs to store data for async defer */

	void				*async_data;

	/* linked requests, IFF REQ_F_HARDLINK or REQ_F_LINK are set */

	atomic_t			poll_refs;

	struct io_kiocb			*link;

	/* custom credentials, valid IFF REQ_F_CREDS is set */

	const struct cred		*creds;

io_uring/cancel.h

+2 −2
Original line number Diff line number Diff line
@@ -27,10 +27,10 @@ bool io_cancel_req_match(struct io_kiocb *req, struct io_cancel_data *cd); 


static inline bool io_cancel_match_sequence(struct io_kiocb *req, int sequence)

{

	if ((req->flags & REQ_F_CANCEL_SEQ) && sequence == req->work.cancel_seq)

	if (req->cancel_seq_set && sequence == req->work.cancel_seq)

		return true;



	req->flags |= REQ_F_CANCEL_SEQ;

	req->cancel_seq_set = true;

	req->work.cancel_seq = sequence;

	return false;

}

io_uring/io_uring.c

+1 −0
Original line number Diff line number Diff line
@@ -2058,6 +2058,7 @@ static int io_init_req(struct io_ring_ctx *ctx, struct io_kiocb *req, 
	req->file = NULL;

	req->rsrc_node = NULL;

	req->task = current;

	req->cancel_seq_set = false;



	if (unlikely(opcode >= IORING_OP_LAST)) {

		req->opcode = 0;