• Breno Leitao's avatar
    io_uring/io-wq: Use set_bit() and test_bit() at worker->flags · 8a565304
    Breno Leitao authored
    Utilize set_bit() and test_bit() on worker->flags within io_uring/io-wq
    to address potential data races.
    
    The structure io_worker->flags may be accessed through various data
    paths, leading to concurrency issues. When KCSAN is enabled, it reveals
    data races occurring in io_worker_handle_work and
    io_wq_activate_free_worker functions.
    
    	 BUG: KCSAN: data-race in io_worker_handle_work / io_wq_activate_free_worker
    	 write to 0xffff8885c4246404 of 4 bytes by task 49071 on cpu 28:
    	 io_worker_handle_work (io_uring/io-wq.c:434 io_uring/io-wq.c:569)
    	 io_wq_worker (io_uring/io-wq.c:?)
    <snip>
    
    	 read to 0xffff8885c4246404 of 4 bytes by task 49024 on cpu 5:
    	 io_wq_activate_free_worker (io_uring/io-wq.c:? io_uring/io-wq.c:285)
    	 io_wq_enqueue (io_uring/io-wq.c:947)
    	 io_queue_iowq (io_uring/io_uring.c:524)
    	 io_req_task_submit (io_uring/io_uring.c:1511)
    	 io_handle_tw_list (io_uring/io_uring.c:1198)
    <snip>
    
    Line numbers against commit 18daea77 ("Merge tag 'for-linus' of
    git://git.kernel.org/pub/scm/virt/kvm/kvm").
    
    These races involve writes and reads to the same memory location by
    different tasks running on different CPUs. To mitigate this, refactor
    the code to use atomic operations such as set_bit(), test_bit(), and
    clear_bit() instead of basic "and" and "or" operations. This ensures
    thread-safe manipulation of worker flags.
    
    Also, move `create_index` to avoid holes in the structure.
    Signed-off-by: default avatarBreno Leitao <leitao@debian.org>
    Link: https://lore.kernel.org/r/20240507170002.2269003-1-leitao@debian.orgSigned-off-by: default avatarJens Axboe <axboe@kernel.dk>
    8a565304
io-wq.c 32.7 KB