From patchwork Wed Oct 19 08:21:42 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 4499 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:4ac7:0:0:0:0:0 with SMTP id y7csp202292wrs; Wed, 19 Oct 2022 01:40:19 -0700 (PDT) X-Google-Smtp-Source: AMsMyM4eXJKXRsCXkKdlnWKxNvAUVMJPRelIinLGildLCGuH2z4XuKJ8zFJuy2k82o1v1M3kpT3v X-Received: by 2002:a17:906:8a48:b0:78d:acdc:b7d9 with SMTP id gx8-20020a1709068a4800b0078dacdcb7d9mr5914614ejc.500.1666168819222; Wed, 19 Oct 2022 01:40:19 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1666168819; cv=none; d=google.com; s=arc-20160816; b=oVr76sK7qhkqVcWAh4UlBkJNxXNp32M/VKec/uA6XmgkG2mwwmhjoMxOPzRaAte11i vq+A1XdH2YjMM+ypJghtidzVjG2Xi7SctMHpgtkHNkRAEvmL23uvhkDWyRVh8BJblf+p +2AGcPt2QzodrCFH/VR5lYGSkAd6+JmNI238zN4PzUf5zkVBV+dytdB4IFaYtGtlnEV0 3MMYN6wC4TR80eaf3UchgqIOVxJplZzZHYIFPq1WsyIfrAYbwrS7i6xv8aRrimIo+cNk 0dIO2M9fcoRD0vw2VOC7n8LYh5AZ/KDBNjibHmpakxYt0CoMsuCXHMmzLLMuXfykmefb NHzA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=+N5nLQVKkAN4nrxK3aDqgG7rFNCtQpOrSklnQPgCv0I=; b=tycobQt6q2U07FKbdB4YPlllWfh5hXnQsDFklgS9Tl3sRYF5YLyQ0f4TkH3vt+oKnH lMLEU7PtU3U6fZf/uYv0XrYgY49qHXM48Gn/cF1Vk5PzceIRYQX8XhT63kOfpzSCuEyK 0F0LO/KfW8SSQiuQ2LfoIB2V2s3/vXQfXMWASqJnHvZiE1yAjK/9tsQYoMygnjfZ/r2T vXNOjORqlejTveomLnkhs85sKZo4We+tJJsS9aRelfxauQwgKbdNWXLzRMINiNOAJMFu U3nuODA55uYIjUGvuv+PHeQC0qn/z53G9FZnu0yv9NbFioMgWHqE/8ucPmg7ernqmRME zZIw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=lJuUpEjy; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id p11-20020a056402500b00b0045d292ef641si13622580eda.493.2022.10.19.01.39.54; Wed, 19 Oct 2022 01:40:19 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=lJuUpEjy; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230272AbiJSIjJ (ORCPT + 99 others); Wed, 19 Oct 2022 04:39:09 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54886 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230241AbiJSIii (ORCPT ); Wed, 19 Oct 2022 04:38:38 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [IPv6:2604:1380:40e1:4800::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C5B1780BD4; Wed, 19 Oct 2022 01:38:09 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 70DCCCE20DB; Wed, 19 Oct 2022 08:37:48 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 673F3C433D6; Wed, 19 Oct 2022 08:37:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1666168666; bh=B3ERKmsNnN430Zj+rZLDONZtKrHxu1wQ+S1atC0iTRk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lJuUpEjyzlaNFsGhcJ4pVFs4omO5dj9VlSF3b30po7RwNV9feOYaqoGUbbFPsNIuO w0BnOgqO1afFo8o3F4FjGHalv/JUfDc6/8yuruN7DAdlw28Isd/uHKcVkcW/hUDBha wdX7xmTyBe19AJnEk9vEP3Qf7KaOev5tHFN8wVpc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Stefan Metzmacher , Pavel Begunkov , Jens Axboe Subject: [PATCH 6.0 015/862] io_uring/net: fix fast_iov assignment in io_setup_async_msg() Date: Wed, 19 Oct 2022 10:21:42 +0200 Message-Id: <20221019083250.679094053@linuxfoundation.org> X-Mailer: git-send-email 2.38.0 In-Reply-To: <20221019083249.951566199@linuxfoundation.org> References: <20221019083249.951566199@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 X-Spam-Status: No, score=-7.4 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1747104636055079861?= X-GMAIL-MSGID: =?utf-8?q?1747104636055079861?= From: Stefan Metzmacher commit 3e4cb6ebbb2bad201c1186bc0b7e8cf41dd7f7e6 upstream. I hit a very bad problem during my tests of SENDMSG_ZC. BUG(); in first_iovec_segment() triggered very easily. The problem was io_setup_async_msg() in the partial retry case, which seems to happen more often with _ZC. iov_iter_iovec_advance() may change i->iov in order to have i->iov_offset being only relative to the first element. Which means kmsg->msg.msg_iter.iov is no longer the same as kmsg->fast_iov. But this would rewind the copy to be the start of async_msg->fast_iov, which means the internal state of sync_msg->msg.msg_iter is inconsitent. I tested with 5 vectors with length like this 4, 0, 64, 20, 8388608 and got a short writes with: - ret=2675244 min_ret=8388692 => remaining 5713448 sr->done_io=2675244 - ret=-EAGAIN => io_uring_poll_arm - ret=4911225 min_ret=5713448 => remaining 802223 sr->done_io=7586469 - ret=-EAGAIN => io_uring_poll_arm - ret=802223 min_ret=802223 => res=8388692 While this was easily triggered with SENDMSG_ZC (queued for 6.1), it was a potential problem starting with 7ba89d2af17aa879dda30f5d5d3f152e587fc551 in 5.18 for IORING_OP_RECVMSG. And also with 4c3c09439c08b03d9503df0ca4c7619c5842892e in 5.19 for IORING_OP_SENDMSG. However 257e84a5377fbbc336ff563833a8712619acce56 introduced the critical code into io_setup_async_msg() in 5.11. Fixes: 7ba89d2af17aa ("io_uring: ensure recv and recvmsg handle MSG_WAITALL correctly") Fixes: 257e84a5377fb ("io_uring: refactor sendmsg/recvmsg iov managing") Cc: stable@vger.kernel.org Signed-off-by: Stefan Metzmacher Reviewed-by: Pavel Begunkov Link: https://lore.kernel.org/r/b2e7be246e2fb173520862b0c7098e55767567a2.1664436949.git.metze@samba.org Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman --- io_uring/net.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/io_uring/net.c +++ b/io_uring/net.c @@ -165,8 +165,10 @@ static int io_setup_async_msg(struct io_ memcpy(async_msg, kmsg, sizeof(*kmsg)); async_msg->msg.msg_name = &async_msg->addr; /* if were using fast_iov, set it to the new one */ - if (!async_msg->free_iov) - async_msg->msg.msg_iter.iov = async_msg->fast_iov; + if (!kmsg->free_iov) { + size_t fast_idx = kmsg->msg.msg_iter.iov - kmsg->fast_iov; + async_msg->msg.msg_iter.iov = &async_msg->fast_iov[fast_idx]; + } return -EAGAIN; }