From patchwork Sat Oct 22 07:18:11 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 7135 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:4242:0:0:0:0:0 with SMTP id s2csp1087224wrr; Sat, 22 Oct 2022 00:35:35 -0700 (PDT) X-Google-Smtp-Source: AMsMyM6ChXnWUWNZl5QNy2R2Y2MA1aMrmUoD2cbSxP/Uq42ENzghOdMB8I2JRi8GHp9GIxTkavrE X-Received: by 2002:a17:907:3e1b:b0:78d:ccd0:c9f8 with SMTP id hp27-20020a1709073e1b00b0078dccd0c9f8mr19583054ejc.705.1666424135161; Sat, 22 Oct 2022 00:35:35 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1666424135; cv=none; d=google.com; s=arc-20160816; b=Mnah+egmyJm6ltOyfwFE+iqjb4/wJU9st57bBC6Kw9r7utpiz1eUuEm24M42YNHCco bTMyaGYRDEyeOGFChOi50RCGF0iN89Vd8gr10jx6AxUr0vb03ZOuTDBySmVMIcCSd4NM FxLjc9zm1kEXc7j0pmMOe9w3VPco3ADsyGPvYrxHoi++wGgxqc536iz5rtY+YstcxySi o3qfWdi58z9oawuyfixXwBzwIY36BddK/sWjjEQItmck9MVEjTeqeWr2mQlg+4ACKnlk UibYUzLE6aUC/G2w53xygkIA7p30abqhXmF6LVpfm0FsxOaQDbVDk54pnZAAe2sh3/uj 5lrQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=+qZwEeyTktkD3SbM0MIT67uzbujkWiOS4Lde+uyu7wo=; b=Q1wdVM5oNYCSxtRObaKu5oXe31Pij7R4lZMjfDdS65RICARxHNdn07ypn8VAjqK0IF iX9lpoB06/QoT4jmXDQb77hoGbDxUuKx+C2Z/k4N0OZ56tdYLgCVslwmHgtXUaVIVBwG t5LV3B43MWOurMxMbpPDzHlsNSH08bqBJ5ya0haKrvczmazdR9YqCN8aXbIxTOJd5odP 49j5dst45JerkP3GZFShWXLC4P9Gi3tDJ618IPtzmZiJo6GANOt77nNI25WURvAwHm5V mvenf390f3fiAQZPmCWbscWxZ1OzFYdzlv6Gu7wagnWWhmwJWYcOjnJ3gKHEwUILloEL MAhA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=pQpTig+w; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id ds1-20020a170907724100b0078e18bd3073si22774348ejc.820.2022.10.22.00.35.10; Sat, 22 Oct 2022 00:35:35 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=pQpTig+w; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230096AbiJVHeW (ORCPT + 99 others); Sat, 22 Oct 2022 03:34:22 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46956 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230129AbiJVHeM (ORCPT ); Sat, 22 Oct 2022 03:34:12 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 928B4237F81; Sat, 22 Oct 2022 00:34:08 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id A80BB60AD9; Sat, 22 Oct 2022 07:34:07 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BC0FDC433D6; Sat, 22 Oct 2022 07:34:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1666424047; bh=jFXfkCbmESFMSgMQFwTsMxOFIK6FkZvxqzNt+bUecq8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=pQpTig+woQjbWnsQ6y0qXzo0a95q1ycXPdw7phjP+xBI3RnihBJVRs9GvF64Lc1K+ NVWNeNQmjwSr3ZHoSQc7U4SuDWQXDS6JE4KKEZVme7QldDOiI9h5T5XYoB2hlpKlpg pttoKGKoPd5I6qA8LHFM4mmwFlsTYtmJGDX8gsYU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Stefan Metzmacher , Pavel Begunkov , Jens Axboe Subject: [PATCH 5.19 012/717] io_uring/net: fix fast_iov assignment in io_setup_async_msg() Date: Sat, 22 Oct 2022 09:18:11 +0200 Message-Id: <20221022072417.268623570@linuxfoundation.org> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221022072415.034382448@linuxfoundation.org> References: <20221022072415.034382448@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 X-Spam-Status: No, score=-7.3 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1747372353885934916?= X-GMAIL-MSGID: =?utf-8?q?1747372353885934916?= From: Stefan Metzmacher commit 3e4cb6ebbb2bad201c1186bc0b7e8cf41dd7f7e6 upstream. I hit a very bad problem during my tests of SENDMSG_ZC. BUG(); in first_iovec_segment() triggered very easily. The problem was io_setup_async_msg() in the partial retry case, which seems to happen more often with _ZC. iov_iter_iovec_advance() may change i->iov in order to have i->iov_offset being only relative to the first element. Which means kmsg->msg.msg_iter.iov is no longer the same as kmsg->fast_iov. But this would rewind the copy to be the start of async_msg->fast_iov, which means the internal state of sync_msg->msg.msg_iter is inconsitent. I tested with 5 vectors with length like this 4, 0, 64, 20, 8388608 and got a short writes with: - ret=2675244 min_ret=8388692 => remaining 5713448 sr->done_io=2675244 - ret=-EAGAIN => io_uring_poll_arm - ret=4911225 min_ret=5713448 => remaining 802223 sr->done_io=7586469 - ret=-EAGAIN => io_uring_poll_arm - ret=802223 min_ret=802223 => res=8388692 While this was easily triggered with SENDMSG_ZC (queued for 6.1), it was a potential problem starting with 7ba89d2af17aa879dda30f5d5d3f152e587fc551 in 5.18 for IORING_OP_RECVMSG. And also with 4c3c09439c08b03d9503df0ca4c7619c5842892e in 5.19 for IORING_OP_SENDMSG. However 257e84a5377fbbc336ff563833a8712619acce56 introduced the critical code into io_setup_async_msg() in 5.11. Fixes: 7ba89d2af17aa ("io_uring: ensure recv and recvmsg handle MSG_WAITALL correctly") Fixes: 257e84a5377fb ("io_uring: refactor sendmsg/recvmsg iov managing") Cc: stable@vger.kernel.org Signed-off-by: Stefan Metzmacher Reviewed-by: Pavel Begunkov Link: https://lore.kernel.org/r/b2e7be246e2fb173520862b0c7098e55767567a2.1664436949.git.metze@samba.org Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman --- io_uring/io_uring.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -5852,8 +5852,10 @@ static int io_setup_async_msg(struct io_ memcpy(async_msg, kmsg, sizeof(*kmsg)); async_msg->msg.msg_name = &async_msg->addr; /* if were using fast_iov, set it to the new one */ - if (!async_msg->free_iov) - async_msg->msg.msg_iter.iov = async_msg->fast_iov; + if (!kmsg->free_iov) { + size_t fast_idx = kmsg->msg.msg_iter.iov - kmsg->fast_iov; + async_msg->msg.msg_iter.iov = &async_msg->fast_iov[fast_idx]; + } return -EAGAIN; }