Skip to contentSkip to conversation

migrating mm

RFC Pavel Begunkov 1 participant 2 messages Nov 12, 2019 io_uring

lore
Share & tools
lore
#0 lore raw

There is a case I'm not sure about, but which bothers me. What would happen, if we try to use io_uring with offloading (i.e. IORING_SETUP_SQPOLL), after its creator is gone? The thing is that io_sq_thread() is getting mm by using ctx->sqo_mm, which is current->mm of the creator process, which potentially may be released.

The case in mind:
let: @parent has a @child process

@child:

    uring_fd = io_uring_create(IORING_SETUP_SQPOLL)
    pass_fd_via_pipe(uring_fd, to=@parent);
    exit()

@parent:

    uring_fd = get_fd_from_pipe()
    wait(@child)

    sqe = create_sqe_which_needs_mm();
    io_submit_sqe(uring_fd, sqe)
    // io_uring tries to grab mm of @child, which is gone.

What do you think?

Signature · 1 line
Pavel Begunkov
#1 lore raw
Quoted 6 lines · Pavel Begunkov

There is a case I'm not sure about, but which bothers me. What would happen, if we try to use io_uring with offloading (i.e. IORING_SETUP_SQPOLL), after its creator is gone? The thing is that io_sq_thread() is getting mm by using ctx->sqo_mm, which is current->mm of the creator process, which potentially may be released.

Please ignore this. The answer is obvious, I just missed mmgrab(current->mm) right at the beginning of io_sq_offload_start().

Quoted 21 lines

The case in mind:
let: @parent has a @child process

@child:

    uring_fd = io_uring_create(IORING_SETUP_SQPOLL)
    pass_fd_via_pipe(uring_fd, to=@parent);
    exit()

@parent:

    uring_fd = get_fd_from_pipe()
    wait(@child)

    sqe = create_sqe_which_needs_mm();
    io_submit_sqe(uring_fd, sqe)
    // io_uring tries to grab mm of @child, which is gone.

What do you think?