io_uring: add request poisoning

Poison various request fields on free. __io_req_caches_free() is a slow
path, so can be done unconditionally, but gate it on kasan for
io_req_add_to_cache(). Note that some fields are logically retained
between cache allocations and can't be poisoned in
io_req_add_to_cache().

Ideally, it'd be replaced with KASAN'ed caches, but that can't be
enabled because of some synchronisation nuances.

Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/7a78e8a7f5be434313c400650b862e36c211b312.1755459452.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/include/linux/poison.h b/include/linux/poison.h
index 8ca2235f78d5d9c070ae816cfd57fe2984db5562..299e2dd7da6d97e5cb0306a4f8fd92ef0d6f2886 100644 (file)
--- a/include/linux/poison.h
+++ b/include/linux/poison.h
@@ -90,4 +90,7 @@
 /********** lib/stackdepot.c **********/
 #define STACK_DEPOT_POISON ((void *)(0xD390 + POISON_POINTER_DELTA))
 
+/********** io_uring/ **********/
+#define IO_URING_PTR_POISON ((void *)(0x1091UL + POISON_POINTER_DELTA))
+
 #endif

diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index 93633613a1657c0b6a618c688501e8e61336cc68..e511949086ddd3361b2169331a492b61fbeacae6 100644 (file)
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -179,6 +179,26 @@ static const struct ctl_table kernel_io_uring_disabled_table[] = {
 };
 #endif
 
+static void io_poison_cached_req(struct io_kiocb *req)
+{
+       req->ctx = IO_URING_PTR_POISON;
+       req->tctx = IO_URING_PTR_POISON;
+       req->file = IO_URING_PTR_POISON;
+       req->creds = IO_URING_PTR_POISON;
+       req->io_task_work.func = IO_URING_PTR_POISON;
+       req->apoll = IO_URING_PTR_POISON;
+}
+
+static void io_poison_req(struct io_kiocb *req)
+{
+       io_poison_cached_req(req);
+       req->async_data = IO_URING_PTR_POISON;
+       req->kbuf = IO_URING_PTR_POISON;
+       req->comp_list.next = IO_URING_PTR_POISON;
+       req->file_node = IO_URING_PTR_POISON;
+       req->link = IO_URING_PTR_POISON;
+}
+
 static inline unsigned int __io_cqring_events(struct io_ring_ctx *ctx)
 {
        return ctx->cached_cq_tail - READ_ONCE(ctx->rings->cq.head);
@@ -235,6 +255,8 @@ static inline void req_fail_link_node(struct io_kiocb *req, int res)
 
 static inline void io_req_add_to_cache(struct io_kiocb *req, struct io_ring_ctx *ctx)
 {
+       if (IS_ENABLED(CONFIG_KASAN))
+               io_poison_cached_req(req);
        wq_stack_add_head(&req->comp_list, &ctx->submit_state.free_list);
 }
 
@@ -2767,6 +2789,7 @@ static __cold void __io_req_caches_free(struct io_ring_ctx *ctx)
 
        while (!io_req_cache_empty(ctx)) {
                req = io_extract_req(ctx);
+               io_poison_req(req);
                kmem_cache_free(req_cachep, req);
                nr++;
        }