io_uring: fix false positive KASAN warnings

commit 569f5308e54352a12181cc0185f848024c5443e8 upstream.

io_req_local_work_add() peeks into the work list, which can be executed
in the meanwhile. It's completely fine without KASAN as we're in an RCU
read section and it's SLAB_TYPESAFE_BY_RCU. With KASAN though it may
trigger a false positive warning because internal io_uring caches are
sanitised.

Remove sanitisation from the io_uring request cache for now.

Cc: stable@vger.kernel.org
Fixes: 8751d15426a31 ("io_uring: reduce scheduling due to tw")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/c6fbf7a82a341e66a0007c76eefd9d57f2d3ba51.1691541473.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index d029e578bdfe1f8d927d0563fccc8f419d015904..4c59201d43c30b7452d62177507f114b7b977e23 100644 (file)
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -231,7 +231,6 @@ static inline void req_fail_link_node(struct io_kiocb *req, int res)
 static inline void io_req_add_to_cache(struct io_kiocb *req, struct io_ring_ctx *ctx)
 {
        wq_stack_add_head(&req->comp_list, &ctx->submit_state.free_list);
-       kasan_poison_object_data(req_cachep, req);
 }
 
 static __cold void io_ring_ctx_ref_free(struct percpu_ref *ref)

diff --git a/io_uring/io_uring.h b/io_uring/io_uring.h
index 259bf798a390eea2e6aa2f82d41b701615c050ca..97cfb3f2f06d082377a36fe5644a4a8194a7bbc0 100644 (file)
--- a/io_uring/io_uring.h
+++ b/io_uring/io_uring.h
@@ -361,7 +361,6 @@ static inline struct io_kiocb *io_extract_req(struct io_ring_ctx *ctx)
        struct io_kiocb *req;
 
        req = container_of(ctx->submit_state.free_list.next, struct io_kiocb, comp_list);
-       kasan_unpoison_object_data(req_cachep, req);
        wq_stack_extract(&ctx->submit_state.free_list);
        return req;
 }