KCSAN: data-race in __bio_queue_enter / __blk_mq_unfreeze_queue#637
Open
blktests-ci[bot] wants to merge 12 commits intofor-next_basefrom
Open
KCSAN: data-race in __bio_queue_enter / __blk_mq_unfreeze_queue#637blktests-ci[bot] wants to merge 12 commits intofor-next_basefrom
blktests-ci[bot] wants to merge 12 commits intofor-next_basefrom
Conversation
If DEFER_TASKRUN | SETUP_TASKRUN is used and task work is added while the ring is being resized, it's possible for the OR'ing of IORING_SQ_TASKRUN to happen in the small window of swapping into the new rings and the old rings being freed. Prevent this by adding a 2nd ->rings pointer, ->rings_rcu, which is protected by RCU. The task work flags manipulation is inside RCU already, and if the resize ring freeing is done post an RCU synchronize, then there's no need to add locking to the fast path of task work additions. Note: this is only done for DEFER_TASKRUN, as that's the only setup mode that supports ring resizing. If this ever changes, then they too need to use the io_ctx_mark_taskrun() helper. Link: https://lore.kernel.org/io-uring/20260309062759.482210-1-naup96721@gmail.com/ Cc: stable@vger.kernel.org Fixes: 79cfe9e ("io_uring/register: add IORING_REGISTER_RESIZE_RINGS") Reported-by: Hao-Yu Yang <naup96721@gmail.com> Suggested-by: Pavel Begunkov <asml.silence@gmail.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
* block-7.0: ublk: don't clear GD_SUPPRESS_PART_SCAN for unprivileged daemons ublk: fix NULL pointer dereference in ublk_ctrl_set_size()
* io_uring-7.0: io_uring: ensure ctx->rings is stable for task work flags manipulation io_uring/bpf_filter: use bpf_prog_run_pin_on_cpu() to prevent migration io_uring/register: fix comment about task_no_new_privs
* for-7.1/block: (27 commits) block: remove bdev_nonrot() block: Correct comments on bio_alloc_clone() and bio_init_clone() Documentation: ABI: stable: document the zoned_qd1_writes attribute block: default to QD=1 writes for blk-mq rotational zoned devices block: allow submitting all zone writes from a single context block: rename struct gendisk zone_wplugs_lock field block: remove disk_zone_is_full() block: rename and simplify disk_get_and_lock_zone_wplug() block: fix zone write plugs refcount handling in disk_zone_wplug_schedule_bio_work() block: fix zone write plug removal block: annotate struct request_queue with __counted_by_ptr sed-opal: add IOC_OPAL_GET_SUM_STATUS ioctl. sed-opal: increase column attribute type size to 64 bits. sed-opal: add IOC_OPAL_ENABLE_DISABLE_LR. sed-opal: add IOC_OPAL_LR_SET_START_LEN ioctl. sed-opal: refactor (split) IOC_OPAL_LR_SETUP internals. sed-opal: add IOC_OPAL_REACTIVATE_LSP. sed-opal: add Admin1PIN parameter. sed-opal: add RangeStartRangeLengthPolicy parameter. sed-opal: add UID of Locking Table. ...
* for-7.1/io_uring: io_uring/zctx: separate notification user_data io_uring/net: allow vectorised regbuf send zc io_uring/timeout: immediate timeout arg io_uring/timeout: migrate reqs from ts64 to ktime io_uring/timeout: add helper for parsing user time io_uring/timeout: check unused sqe fields io_uring/zcrx: move zcrx uapi into separate header io_uring/zcrx: declare some constants for query io_uring/zctx: unify zerocopy issue variants io_uring/zctx: move vec regbuf import into io_send_zc_import io_uring/zctx: rename flags var for more clarity io_uring/cmd_net: split ioctl code out of io_uring_cmd_sock()
Similarly to what commit e78f7b7 did for local task work additions, use ->rings_rcu under RCU rather than dereference ->rings directly. See that commit for more details. Cc: stable@vger.kernel.org Fixes: 79cfe9e ("io_uring/register: add IORING_REGISTER_RESIZE_RINGS") Signed-off-by: Jens Axboe <axboe@kernel.dk>
* io_uring-7.0: io_uring/eventfd: use ctx->rings_rcu for flags checking
When IORING_SETUP_SQE_MIXED is used without IORING_SETUP_NO_SQARRAY, the boundary check for 128-byte SQE operations in io_init_req() validated the logical SQ head position rather than the physical SQE index. The existing check: !(ctx->cached_sq_head & (ctx->sq_entries - 1)) ensures the logical position isn't at the end of the ring, which is correct for NO_SQARRAY rings where physical == logical. However, when sq_array is present, an unprivileged user can remap any logical position to an arbitrary physical index via sq_array. Setting sq_array[N] = sq_entries - 1 places a 128-byte operation at the last physical SQE slot, causing the 128-byte memcpy in io_uring_cmd_sqe_copy() to read 64 bytes past the end of the SQE array. Replace the cached_sq_head alignment check with a direct validation of the physical SQE index, which correctly handles both sq_array and NO_SQARRAY cases. Fixes: 1cba30b ("io_uring: add support for IORING_SETUP_SQE_MIXED") Signed-off-by: Tom Ryan <ryan36005@gmail.com> Link: https://patch.msgid.link/20260310052003.72871-1-ryan36005@gmail.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
* io_uring-7.0: io_uring: fix physical SQE bounds check for SQE_MIXED 128-byte ops
* for-7.1/block: block: clear BIO_QOS flags in blk_steal_bios() block: move bio queue-transition flag fixups into blk_steal_bios()
* block-7.0: s390/dasd: Copy detected format information to secondary device s390/dasd: Move quiesce state with pprc swap
Author
|
Upstream branch: 1e84542 Pull request is NOT updated. Failed to apply https://patchwork.kernel.org/project/linux-block/list/?series=1064880 conflict: |
blktests-ci
bot
force-pushed
the
for-next_base
branch
from
efdfeb2 to
6a5c31a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pull request for series with
subject: KCSAN: data-race in __bio_queue_enter / __blk_mq_unfreeze_queue
version: 1
url: https://patchwork.kernel.org/project/linux-block/list/?series=1064880