mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-05 18:39:59 +00:00
io_uring/net: fix fast_iov assignment in io_setup_async_msg()
commit3e4cb6ebbb
upstream. I hit a very bad problem during my tests of SENDMSG_ZC. BUG(); in first_iovec_segment() triggered very easily. The problem was io_setup_async_msg() in the partial retry case, which seems to happen more often with _ZC. iov_iter_iovec_advance() may change i->iov in order to have i->iov_offset being only relative to the first element. Which means kmsg->msg.msg_iter.iov is no longer the same as kmsg->fast_iov. But this would rewind the copy to be the start of async_msg->fast_iov, which means the internal state of sync_msg->msg.msg_iter is inconsitent. I tested with 5 vectors with length like this 4, 0, 64, 20, 8388608 and got a short writes with: - ret=2675244 min_ret=8388692 => remaining 5713448 sr->done_io=2675244 - ret=-EAGAIN => io_uring_poll_arm - ret=4911225 min_ret=5713448 => remaining 802223 sr->done_io=7586469 - ret=-EAGAIN => io_uring_poll_arm - ret=802223 min_ret=802223 => res=8388692 While this was easily triggered with SENDMSG_ZC (queued for 6.1), it was a potential problem starting with7ba89d2af1
in 5.18 for IORING_OP_RECVMSG. And also with4c3c09439c
in 5.19 for IORING_OP_SENDMSG. However257e84a537
introduced the critical code into io_setup_async_msg() in 5.11. Fixes:7ba89d2af1
("io_uring: ensure recv and recvmsg handle MSG_WAITALL correctly") Fixes:257e84a537
("io_uring: refactor sendmsg/recvmsg iov managing") Cc: stable@vger.kernel.org Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Pavel Begunkov <asml.silence@gmail.com> Link: https://lore.kernel.org/r/b2e7be246e2fb173520862b0c7098e55767567a2.1664436949.git.metze@samba.org Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
89a77271d2
commit
fc2491562a
1 changed files with 4 additions and 2 deletions
|
@ -4681,8 +4681,10 @@ static int io_setup_async_msg(struct io_kiocb *req,
|
||||||
if (async_msg->msg.msg_name)
|
if (async_msg->msg.msg_name)
|
||||||
async_msg->msg.msg_name = &async_msg->addr;
|
async_msg->msg.msg_name = &async_msg->addr;
|
||||||
/* if were using fast_iov, set it to the new one */
|
/* if were using fast_iov, set it to the new one */
|
||||||
if (!async_msg->free_iov)
|
if (!kmsg->free_iov) {
|
||||||
async_msg->msg.msg_iter.iov = async_msg->fast_iov;
|
size_t fast_idx = kmsg->msg.msg_iter.iov - kmsg->fast_iov;
|
||||||
|
async_msg->msg.msg_iter.iov = &async_msg->fast_iov[fast_idx];
|
||||||
|
}
|
||||||
|
|
||||||
return -EAGAIN;
|
return -EAGAIN;
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in a new issue