Pull io_uring fixes from Jens Axboe: "A fix for sendmsg with CMSG, and the followup fix discussed for avoiding touching task->worker_private after the worker has started exiting" * tag 'io_uring-6.4-2023-06-15' of git://git.kernel.dk/linux: io_uring/io-wq: clear current->worker_private on exit io_uring/net: save msghdr->msg_control for retries
Unified · Split
| @@ -220,7 +220,12 @@ static void io_worker_exit(struct io_worker *worker) · 219 unmodified lines | ||
| 220 | 220 | list_del_rcu(&worker->all_list); |
| 221 | 221 | raw_spin_unlock(&wq->lock); |
| 222 | 222 | io_wq_dec_running(worker); |
| 223 | − worker->flags = 0; | |
| 223 | + /* | |
| 224 | + * this worker is a goner, clear ->worker_private to avoid any | |
| 225 | + * inc/dec running calls that could happen as part of exit from | |
| 226 | + * touching 'worker'. | |
| 227 | + */ | |
| 228 | + current->worker_private = NULL; | |
| 224 | 229 | |
| 225 | 230 | kfree_rcu(worker, rcu); |
| 226 | 231 | io_worker_ref_put(wq); |
| @@ -65,6 +65,7 @@ struct io_sr_msg { · 64 unmodified lines | ||
| 65 | 65 | u16 addr_len; |
| 66 | 66 | u16 buf_group; |
| 67 | 67 | void __user *addr; |
| 68 | + void __user *msg_control; | |
| 68 | 69 | /* used only for send zerocopy */ |
| 69 | 70 | struct io_kiocb *notif; |
| 70 | 71 | }; |
| @@ -195,11 +196,15 @@ static int io_sendmsg_copy_hdr(struct io_kiocb *req, · 124 unmodified lines | ||
| 195 | 196 | struct io_async_msghdr *iomsg) |
| 196 | 197 | { |
| 197 | 198 | struct io_sr_msg *sr = io_kiocb_to_cmd(req, struct io_sr_msg); |
| 199 | + int ret; | |
| 198 | 200 | |
| 199 | 201 | iomsg->msg.msg_name = &iomsg->addr; |
| 200 | 202 | iomsg->free_iov = iomsg->fast_iov; |
| 201 | − return sendmsg_copy_msghdr(&iomsg->msg, sr->umsg, sr->msg_flags, | |
| 203 | + ret = sendmsg_copy_msghdr(&iomsg->msg, sr->umsg, sr->msg_flags, | |
| 202 | 204 | &iomsg->free_iov); |
| 205 | + /* save msg_control as sys_sendmsg() overwrites it */ | |
| 206 | + sr->msg_control = iomsg->msg.msg_control; | |
| 207 | + return ret; | |
| 203 | 208 | } |
| 204 | 209 | |
| 205 | 210 | int io_send_prep_async(struct io_kiocb *req) |
| @@ -297,6 +302,7 @@ int io_sendmsg(struct io_kiocb *req, unsigned int issue_flags) · 91 unmodified lines | ||
| 297 | 302 | |
| 298 | 303 | if (req_has_async_data(req)) { |
| 299 | 304 | kmsg = req->async_data; |
| 305 | + kmsg->msg.msg_control = sr->msg_control; | |
| 300 | 306 | } else { |
| 301 | 307 | ret = io_sendmsg_copy_hdr(req, &iomsg); |
| 302 | 308 | if (ret) |