All of lore.kernel.org
 help / color / mirror / Atom feed
From: Hao Xu <hao.xu@linux.dev>
To: Jens Axboe <axboe@kernel.dk>, io-uring <io-uring@vger.kernel.org>
Cc: Pavel Begunkov <asml.silence@gmail.com>
Subject: Re: Possible bug for ring-mapped provided buffer
Date: Fri, 10 Jun 2022 00:08:01 +0800	[thread overview]
Message-ID: <82993fe0-9a38-d87b-5eb3-32dc33464d43@linux.dev> (raw)
In-Reply-To: <78e3cf67-a3f2-0ca3-4b83-27aa738c3b20@kernel.dk>

On 6/9/22 23:06, Jens Axboe wrote:
> On 6/9/22 4:32 AM, Hao Xu wrote:
>> On 6/9/22 18:19, Jens Axboe wrote:
>>> On 6/9/22 4:14 AM, Hao Xu wrote:
>>>> On 6/9/22 18:06, Jens Axboe wrote:
>>>>> On 6/9/22 1:53 AM, Hao Xu wrote:
>>>>>> Hi all,
>>>>>> I haven't done tests to demonstrate it. It is for partial io case, we
>>>>>> don't consume/release the buffer before arm_poll in ring-mapped mode.
>>>>>> But seems we should? Otherwise ring head isn't moved and other requests
>>>>>> may take that buffer. What do I miss?
>>>>>
>>>>> On vacation this week, so can't take a look at the code. But the
>>>>> principle is precisely not to consume the buffer if we arm poll, because
>>>>> then the next one can grab it instead. We don't want to consume a buffer
>>>>> over poll, as that defeats the purpose of a provided buffer. It should
>>>>> be grabbed and consumed only if we can use it right now.
>>>>>
>>>>> Hence the way it should work is that we DON'T consume the buffer in this
>>>>> case, and that someone else can just use it. At the same time, we should
>>>>> ensure that we grab a NEW buffer for this case, whenever the poll
>>>>
>>>> If we grab a new buffer for it, then we have to copy the data since we
>>>> have done partial io...this also defeats the purpose of this feature.
>>>
>>> For partial IO, we never drop the buffer. See the logic in
>>> io_kbuf_recycle(). It should be as follows:
>>
>> Yea, in io_kbuf_recycle(), if it's partial io, we just return. For
>> legacy mode, this means we keep the buffer. For ring-mapped mode, this
>> means we then release the uring_lock without moving the ring->head,
>> and then other requests may take that buffer which is in use..
>> And next time we do (for example) recv(), we lost the data which we got
>> at the previous time.
>> Do I miss something?
> 
> If we don't commit for ring mapped buffers, then yeah that's definitely
> a bug. Please send a fix :-)
> 
> Pavel can take care of it this week.
> 

I'll send a patch tomorrow.

Thanks,
Hao

      reply	other threads:[~2022-06-09 16:08 UTC|newest]

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-06-09  7:53 Possible bug for ring-mapped provided buffer Hao Xu
2022-06-09  9:33 ` Hao Xu
2022-06-09  9:54   ` Hao Xu
2022-06-09 10:06 ` Jens Axboe
2022-06-09 10:14   ` Hao Xu
2022-06-09 10:19     ` Jens Axboe
2022-06-09 10:32       ` Hao Xu
2022-06-09 15:06         ` Jens Axboe
2022-06-09 16:08           ` Hao Xu [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=82993fe0-9a38-d87b-5eb3-32dc33464d43@linux.dev \
    --to=hao.xu@linux.dev \
    --cc=asml.silence@gmail.com \
    --cc=axboe@kernel.dk \
    --cc=io-uring@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.