superrob1500
/
mirror-linux
mirror of https://github.com/torvalds/linux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

io_uring: add request poisoning 

Poison various request fields on free. __io_req_caches_free() is a slow
path, so can be done unconditionally, but gate it on kasan for
io_req_add_to_cache(). Note that some fields are logically retained
between cache allocations and can't be poisoned in
io_req_add_to_cache().

Ideally, it'd be replaced with KASAN'ed caches, but that can't be
enabled because of some synchronisation nuances.

Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/7a78e8a7f5be434313c400650b862e36c211b312.1755459452.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
pull/1354/merge
Pavel Begunkov 2025-08-17 23:09:18 +01:00 committed by Jens Axboe
parent 1b237f190e
commit 92a96b0a22
2 changed files with 26 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
include/linux/poison.h
View File

@ -90,4 +90,7 @@
/********** lib/stackdepot.c **********/
#define STACK_DEPOT_POISON ((void *)(0xD390 + POISON_POINTER_DELTA))
/********** io_uring/ **********/
#define IO_URING_PTR_POISON ((void *)(0x1091UL + POISON_POINTER_DELTA))
#endif

23
io_uring/io_uring.c
View File

@ -179,6 +179,26 @@ static const struct ctl_table kernel_io_uring_disabled_table[] = {
};
#endif
static void io_poison_cached_req(struct io_kiocb *req)
{
req->ctx = IO_URING_PTR_POISON;
req->tctx = IO_URING_PTR_POISON;
req->file = IO_URING_PTR_POISON;
req->creds = IO_URING_PTR_POISON;
req->io_task_work.func = IO_URING_PTR_POISON;
req->apoll = IO_URING_PTR_POISON;
}
static void io_poison_req(struct io_kiocb *req)
{
io_poison_cached_req(req);
req->async_data = IO_URING_PTR_POISON;
req->kbuf = IO_URING_PTR_POISON;
req->comp_list.next = IO_URING_PTR_POISON;
req->file_node = IO_URING_PTR_POISON;
req->link = IO_URING_PTR_POISON;
}
static inline unsigned int __io_cqring_events(struct io_ring_ctx *ctx)
{
return ctx->cached_cq_tail - READ_ONCE(ctx->rings->cq.head);
@ -235,6 +255,8 @@ static inline void req_fail_link_node(struct io_kiocb *req, int res)
static inline void io_req_add_to_cache(struct io_kiocb *req, struct io_ring_ctx *ctx)
{
if (IS_ENABLED(CONFIG_KASAN))
io_poison_cached_req(req);
wq_stack_add_head(&req->comp_list, &ctx->submit_state.free_list);
}
@ -2767,6 +2789,7 @@ static __cold void __io_req_caches_free(struct io_ring_ctx *ctx)
while (!io_req_cache_empty(ctx)) {
req = io_extract_req(ctx);
io_poison_req(req);
kmem_cache_free(req_cachep, req);
nr++;
}