lkml.org 
[lkml]   [2022]   [Nov]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
Subjectio_uring / POLLFREE bug
Hello,

I wanted (as an exercise) to dive into recent io_uring / POLLFREE pb and try to understand what really happens under the hood. I looked at this commit of yours : https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit?h=linux-5.4.y&id=fc78b2fc21f10c4c9c4d5d659a685710ffa63659 and tried to investigate from there. Basically, I tried to produce the bug / trigger a crash with a small C code (using liburing) that creates a signalfd() and polls it with io_uring. I failed until now to understand what happens.

This is my understanding of the situation :
- "signalfd_wqh" is a queue created during task creation (kernel/fork.c:sighand_ctor())
- it is freed with kmem_cache_free() at task end (kernel/fork.c/__cleanup_sighand())
- before it is freed, there is a call to signalfd_cleanup() that sends a POLLFREE (kernel/fork.c/__cleanup_sighand())
- waiters are supposed to use this POLLFREE to stop polling and free resources, but io_uring does not do that 
- the bug is that : io_uring_poll (io_uring.c) calls signalfd_poll() using signalfd_wqh as its poll_table parameter, but it has been freed (poll_wait, should crash I suppose)
- since the task must be finished, we *MUST* use "kernel polled" mode, to allow kernel to continue polling after the memory was freed. Otherwise we can't trigger the bug, can we ?
- but then, why would kernel enter io_uring_poll after task was terminated ?

Thanks again and keep up the good work

\
 
 \ /
  Last update: 2022-11-19 23:20    [W:0.029 / U:1.328 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site