io_uring concerns

[vch9]

Hey eio's team,

We are working on switching our project from lwt to eio. We were expecting to improve our performances by using io_uring, but we are a little bit concerned because of google's report. I was wondering what's your feeling about io_uring as you decided to support it in eio? I understand that we can choose the posix variant. Have you considered the security reports and eio relies only of a subset of "safe" utilities from io_uring for example?

Please let me know if this issue rather belong to https://github.com/ocaml-multicore/ocaml-uring

[talex5]

I haven't look at the individual issues, but I would guess such problems mosly occur when you send malformed data, which Eio shouldn't be doing. So Eio using uring shouldn't affect your security, what matters is whether you have uring enabled on your system or not. If you decide to disable uring, Eio should fall back to using the posix backend automatically. But if it's there, we might as well use it.

(one exception I know is that performing innocent writes to zfs files using a uring fixed buffer can cause zfs to get stuck in a loop: openzfs/zfs#16133)

[avsm]

I agree with @talex5's assessment. The ZFS bug is a really painful problem though, and is the reason I've actually had to disable eio usage on almost all my services as I use ZFS and XFS extensively.

We could drop Eio-uring down to a non-default mode that's activated by an environment variable, @talex5?

[talex5]

We could drop Eio-uring down to a non-default mode that's activated by an environment variable, @talex5?

Just set EIO_BACKEND=posix. Or we could just get rid of fixed buffers.

[avsm]

How about leaving the default to io_uring, but making fixed buffers optional via an environment variable instead of ripping them out? It would be nice to leave that functionality in (I'm convinced it's of use in some workloads).

I do set the backend to posix, but one slip and there's a non-killable biowaiting process spinning a core, and that's... stressful... when you can't reboot the box due to other users ;-)

[toastal]

I do set the backend to posix, but one slip and there's a non-killable biowaiting process spinning a core, and that's... stressful... when you can't reboot the box due to other users ;-)

Boy, did we lose a lot of time trying to debug this. My setup is OpenZFS on Linux (I have another box on XFS). …& I already rebooted once from a runaway, unkillable processes.