io_uring: add request poisoning
authorPavel Begunkov <asml.silence@gmail.com>
Sun, 17 Aug 2025 22:09:18 +0000 (23:09 +0100)
committerJens Axboe <axboe@kernel.dk>
Sun, 24 Aug 2025 17:41:11 +0000 (11:41 -0600)
commit92a96b0a227e91dc42475265a1ce766b6cd044fa
treef4acad45af7444febdfaecb0adff850bf2279dbb
parent1b237f190eb3d36f52dffe07a40b5eb210280e00
io_uring: add request poisoning

Poison various request fields on free. __io_req_caches_free() is a slow
path, so can be done unconditionally, but gate it on kasan for
io_req_add_to_cache(). Note that some fields are logically retained
between cache allocations and can't be poisoned in
io_req_add_to_cache().

Ideally, it'd be replaced with KASAN'ed caches, but that can't be
enabled because of some synchronisation nuances.

Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/7a78e8a7f5be434313c400650b862e36c211b312.1755459452.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
include/linux/poison.h
io_uring/io_uring.c