Re: [BUG] fs/aio: io_setup integer wrap can exhaust global aio quota

[Cheng Yongkang <teel4res@gmail.com>]

Hi Ben,

Here is the exact path, step by step, with the values at each line of
v7.3 fs/aio.c (commit 08ab31164c55). Precondition: root has set
fs.aio-max-nr to 2147483649 (0x80000001); fs.aio-nr is 0.

The caller does io_setup(0x80000001, &ctx).

1. Line 796:  max_reqs = nr_events;
              max_reqs = 0x80000001

2. Line 807:  nr_events = max(nr_events, num_possible_cpus() * 4);
              nr_events = 0x80000001

3. Line 808:  nr_events *= 2;
              0x80000001 * 2 = 0x100000002, which does not fit in
              32 bits, so nr_events = 2

4. Line 811:  if (nr_events > 0x10000000U / sizeof(struct io_event))
              2 > 8388608 is false, so no return

5. Line 816:  if (!nr_events || max_reqs > aio_max_nr)
              nr_events is 2, and 0x80000001 > 0x80000001 is false,
              so no return

6. Line 845:  aio_setup_ring(ctx, nr_events)  with nr_events = 2
              succeeds and builds a one-page ring (127 slots)

7. Line 856:  if (aio_nr + ctx->max_reqs > aio_max_nr || ...)
              0 + 0x80000001 > 0x80000001 is false, so no error

8. Line 862:  aio_nr += ctx->max_reqs;
              aio_nr = 0x80000001        <-- aio_nr is updated here

9. Line 868:  err = ioctx_add_table(ctx, mm);
              returns 0                  <-- ioctx_add_table() is called

10. Line 877: return ctx;
              io_setup() returns 0 and the context is live.

You can check it in under a minute:

  # sysctl -w fs.aio-max-nr=2147483649
  # cat /proc/sys/fs/aio-nr
  0
  ... run io_setup(0x80000001, &ctx) ...
  # cat /proc/sys/fs/aio-nr
  2147483649

If aio_nr were never updated, the second read would be 0. It is
2147483649. The context returned in step 10 also works with
io_submit() and io_getevents(), which is only possible if
ioctx_add_table() installed it.

The early return you describe is real, but it is step 5 with the
default fs.aio-max-nr of 65536. That is not the configuration in
the report.

I am not asking you to take a patch. I only want the record to be
accurate: on this path, aio_nr is updated and ioctx_add_table() is
called.

Thanks,
Cheng