Messages in this thread | | | Date | Sat, 19 Nov 2022 22:19:05 +0000 | From | Alexandre <> | Subject | io_uring / POLLFREE bug |
| |
Hello,
I wanted (as an exercise) to dive into recent io_uring / POLLFREE pb and try to understand what really happens under the hood. I looked at this commit of yours : https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit?h=linux-5.4.y&id=fc78b2fc21f10c4c9c4d5d659a685710ffa63659 and tried to investigate from there. Basically, I tried to produce the bug / trigger a crash with a small C code (using liburing) that creates a signalfd() and polls it with io_uring. I failed until now to understand what happens.
This is my understanding of the situation : - "signalfd_wqh" is a queue created during task creation (kernel/fork.c:sighand_ctor()) - it is freed with kmem_cache_free() at task end (kernel/fork.c/__cleanup_sighand()) - before it is freed, there is a call to signalfd_cleanup() that sends a POLLFREE (kernel/fork.c/__cleanup_sighand()) - waiters are supposed to use this POLLFREE to stop polling and free resources, but io_uring does not do that - the bug is that : io_uring_poll (io_uring.c) calls signalfd_poll() using signalfd_wqh as its poll_table parameter, but it has been freed (poll_wait, should crash I suppose) - since the task must be finished, we *MUST* use "kernel polled" mode, to allow kernel to continue polling after the memory was freed. Otherwise we can't trigger the bug, can we ? - but then, why would kernel enter io_uring_poll after task was terminated ?
Thanks again and keep up the good work
| |