pg.ddx.io pgsql-committers@postgresql.org mailing list archivehelp / color / mirror / Atom feed
pgsql: aio: io_uring: Fix danger of completion getting reused before be 2+ messages / 1 participants [nested] [flat]
* pgsql: aio: io_uring: Fix danger of completion getting reused before be @ 2026-01-15 16:10 Andres Freund <andres@anarazel.de> 0 siblings, 0 replies; 2+ messages in thread From: Andres Freund @ 2026-01-15 16:10 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org aio: io_uring: Fix danger of completion getting reused before being read We called io_uring_cqe_seen(..., cqe) before reading cqe->res. That allows the completion to be reused, which in turn could lead to cqe->res being overwritten. The window for that is very narrow and the likelihood of it happening is very low, as we should never actually utilize all CQEs, but the consequences would be bad. This bug was reported to me privately. Backpatch-through: 18 Discussion: https://postgr.es/m/bwo3e5lj2dgi2wzq4yvbyzu7nmwueczvvzioqsqo6azu6lm5oy@pbx75g2ach3p Branch ------ master Details ------- https://git.postgresql.org/pg/commitdiff/8077649907d40b9831358d0c5121a8c58267a988 Modified Files -------------- src/backend/storage/aio/method_io_uring.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) ^ permalink raw reply [nested|flat] 2+ messages in thread
* pgsql: aio: io_uring: Fix danger of completion getting reused before be @ 2026-01-15 16:10 Andres Freund <andres@anarazel.de> 0 siblings, 0 replies; 2+ messages in thread From: Andres Freund @ 2026-01-15 16:10 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org aio: io_uring: Fix danger of completion getting reused before being read We called io_uring_cqe_seen(..., cqe) before reading cqe->res. That allows the completion to be reused, which in turn could lead to cqe->res being overwritten. The window for that is very narrow and the likelihood of it happening is very low, as we should never actually utilize all CQEs, but the consequences would be bad. This bug was reported to me privately. Backpatch-through: 18 Discussion: https://postgr.es/m/bwo3e5lj2dgi2wzq4yvbyzu7nmwueczvvzioqsqo6azu6lm5oy@pbx75g2ach3p Branch ------ REL_18_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/7f1b3a4cea563d791d8a83e5c482f1ed8306ee6a Modified Files -------------- src/backend/storage/aio/method_io_uring.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) ^ permalink raw reply [nested|flat] 2+ messages in thread
end of thread, other threads:[~2026-01-15 16:10 UTC | newest] Thread overview: 2+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2026-01-15 16:10 pgsql: aio: io_uring: Fix danger of completion getting reused before be Andres Freund <andres@anarazel.de> 2026-01-15 16:10 pgsql: aio: io_uring: Fix danger of completion getting reused before be Andres Freund <andres@anarazel.de>
This inbox is served by DDX for PostgreSQL; see mirroring instructions for how to clone and mirror all data and code used for this inbox