io_uring: add request poisoning
authorPavel Begunkov <asml.silence@gmail.com>
Sun, 17 Aug 2025 22:09:18 +0000 (23:09 +0100)
committerJens Axboe <axboe@kernel.dk>
Mon, 18 Aug 2025 19:11:30 +0000 (13:11 -0600)
commiteb7d5ca9f9b9a5e6b1ebb6a7f1982e498a347cbd
treeee43f1154b7b56910f9710e2dcaf684ca3c40550
parentc17b750b3ad9f45f2b6f7e6f7f4679844244f0b9
io_uring: add request poisoning

Poison various request fields on free. __io_req_caches_free() is a slow
path, so can be done unconditionally, but gate it on kasan for
io_req_add_to_cache(). Note that some fields are logically retained
between cache allocations and can't be poisoned in
io_req_add_to_cache().

Ideally, it'd be replaced with KASAN'ed caches, but that can't be
enabled because of some synchronisation nuances.

Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/7a78e8a7f5be434313c400650b862e36c211b312.1755459452.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
include/linux/poison.h
io_uring/io_uring.c