From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0490A1170E for ; Mon, 11 Sep 2023 14:06:26 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7CE74C433C8; Mon, 11 Sep 2023 14:06:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1694441185; bh=tMHPlk/t8Bi18GfddbmZ0DsrgeAFWlNxonck7mDk6d8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ZRbn11W5ROSow8/+8F9mKatNAgSPz+edK1oIRxIT+LYsJ+eQ+5jxOcbm5KnMj5Bqw iZEiH3P3ZE/CyRlCHdYiZEs2/XvKI5pL/4M/b4cYH71d94HtzTmvuEDXpZCrmABM1N oWFk4Xd4QQv4AORidzg3cz7kUz+Z2glu2bAUB6xo= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Pavel Begunkov , Jens Axboe , Sasha Levin Subject: [PATCH 6.5 325/739] io_uring: fix drain stalls by invalid SQE Date: Mon, 11 Sep 2023 15:42:04 +0200 Message-ID: <20230911134700.179367368@linuxfoundation.org> X-Mailer: git-send-email 2.42.0 In-Reply-To: <20230911134650.921299741@linuxfoundation.org> References: <20230911134650.921299741@linuxfoundation.org> User-Agent: quilt/0.67 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.5-stable review patch. If anyone has any objections, please let me know. ------------------ From: Pavel Begunkov [ Upstream commit cfdbaa3a291d6fd2cb4a1a70d74e63b4abc2f5ec ] cq_extra is protected by ->completion_lock, which io_get_sqe() misses. The bug is harmless as it doesn't happen in real life, requires invalid SQ index array and racing with submission, and only messes up the userspace, i.e. stall requests execution but will be cleaned up on ring destruction. Fixes: 15641e427070f ("io_uring: don't cache number of dropped SQEs") Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/66096d54651b1a60534bb2023f2947f09f50ef73.1691538547.git.asml.silence@gmail.com Signed-off-by: Jens Axboe Signed-off-by: Sasha Levin --- io_uring/io_uring.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c index 93db3e4e7b688..41c0b24db0c0f 100644 --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -2382,7 +2382,9 @@ static bool io_get_sqe(struct io_ring_ctx *ctx, const struct io_uring_sqe **sqe) } /* drop invalid entries */ + spin_lock(&ctx->completion_lock); ctx->cq_extra--; + spin_unlock(&ctx->completion_lock); WRITE_ONCE(ctx->rings->sq_dropped, READ_ONCE(ctx->rings->sq_dropped) + 1); return false; -- 2.40.1