Merge tag 'io_uring-7.2-20260731' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

Pull io_uring fixes from Jens Axboe: - Fix for a bug in how length caps are handled in multishot, and along with it, a generic fix for avoiding these kinds of conversion issues in the future. - Ensure that task restrictions are always preserved across exec. - Revert of the io_uring controlled epoll restriction, which disallowed nested contexts. Turns out that libuv is already using it like that, so we cannot simply remove it, sadly. - Fix for a reference leak in the zcrx code. * tag 'io_uring-7.2-20260731' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring: preserve task restrictions across exec io_uring/zcrx: don't clear master_ctx from the import path Revert "io_uring/epoll: disallow adding an epoll file to an epoll context" io_uring/kbuf: cap buffer selection length at MAX_RW_COUNT io_uring/net: initialize mshot_len for send

Linus Torvalds committed 3 months ago

Commit 5d0c32d2 parents 680d49d bc0e8fa7 files · +15 −7Browse files

Unified · Split

7 files

io_uring/cancel.c +1 −1
io_uring/epoll.c +0 −3
io_uring/kbuf.c +4 −1
io_uring/net.c +1 −0
io_uring/tctx.c +6 −1
io_uring/tctx.h +1 −0
io_uring/zcrx.c +2 −1

io_uring/cancel.c+1−1

@@ -660,6 +660,6 @@ end_wait: · 659 unmodified lines
660	660	*/
661	661	atomic_dec(&tctx->in_cancel);
662	662	/* for exec all current's requests should be gone, kill tctx */
663		− __io_uring_free(current);
	663	+ io_uring_free_tctx(current);
664	664	}
665	665	}

io_uring/epoll.c+0−3

@@ -62,9 +62,6 @@ int io_epoll_ctl(struct io_kiocb *req, unsigned int issue_flags) · 61 unmodified lines
62	62	CLASS(fd, tf)(ie->fd);
63	63	if (fd_empty(tf))
64	64	return -EBADF;
65		− /* disallow adding an epoll context to another epoll context */
66		− if (ie->op == EPOLL_CTL_ADD && is_file_epoll(fd_file(tf)))
67		− return -EINVAL;
68	65
69	66	key.file = fd_file(tf);
70	67	key.fd = ie->fd;

io_uring/kbuf.c+4−1

@@ -266,6 +266,9 @@ static int io_ring_buffers_peek(struct io_kiocb req, struct buf_sel_arg arg, · 265 unmodified lines
266	266	if (unlikely(!nr_avail))
267	267	return -ENOBUFS;
268	268
	269	+ /* MAX_RW_COUNT is the universal Linux per-call IO maximum */
	270	+ arg->max_len = min_t(size_t, arg->max_len, MAX_RW_COUNT);
	271	+
269	272	buf = io_ring_head_to_buf(br, head, bl->mask);
270	273	if (arg->max_len) {
271	274	u32 len = READ_ONCE(buf->len);
@@ -295,7 +298,7 @@ static int io_ring_buffers_peek(struct io_kiocb req, struct buf_sel_arg arg, · 23 unmodified lines
295	298
296	299	/* set it to max, if not set, so we can use it unconditionally */
297	300	if (!arg->max_len)
298		− arg->max_len = INT_MAX;
	301	+ arg->max_len = MAX_RW_COUNT;
299	302
300	303	req->buf_index = READ_ONCE(buf->bid);
301	304	do {

io_uring/net.c+1−0

@@ -445,6 +445,7 @@ int io_sendmsg_prep(struct io_kiocb req, const struct io_uring_sqe sqe) · 444 unmodified lines
445	445	req->flags \|= REQ_F_NOWAIT;
446	446	if (req->flags & REQ_F_BUFFER_SELECT)
447	447	sr->buf_group = req->buf_index;
	448	+ sr->mshot_total_len = sr->mshot_len = 0;
448	449	if (sr->flags & IORING_RECVSEND_BUNDLE) {
449	450	if (req->opcode == IORING_OP_SENDMSG)
450	451	return -EINVAL;

io_uring/tctx.c+6−1

@@ -43,7 +43,7 @@ static struct io_wq io_init_wq_offload(struct io_ring_ctx ctx, · 42 unmodified lines
43	43	return io_wq_create(concurrency, &data);
44	44	}
45	45
46		−void __io_uring_free(struct task_struct *tsk)
	46	+void io_uring_free_tctx(struct task_struct *tsk)
47	47	{
48	48	struct io_uring_task *tctx = tsk->io_uring;
49	49	struct io_tctx_node *node;
@@ -67,6 +67,11 @@ void __io_uring_free(struct task_struct *tsk) · 17 unmodified lines
67	67	kfree(tctx);
68	68	tsk->io_uring = NULL;
69	69	}
	70	+}
	71	+
	72	+void __io_uring_free(struct task_struct *tsk)
	73	+{
	74	+ io_uring_free_tctx(tsk);
70	75	if (tsk->io_uring_restrict) {
71	76	io_put_bpf_filters(tsk->io_uring_restrict);
72	77	kfree(tsk->io_uring_restrict);

io_uring/tctx.h+1−0

@@ -12,6 +12,7 @@ void io_uring_del_tctx_node(unsigned long index); · 11 unmodified lines
12	12	int __io_uring_add_tctx_node(struct io_ring_ctx *ctx);
13	13	int __io_uring_add_tctx_node_from_submit(struct io_ring_ctx *ctx);
14	14	void io_uring_clean_tctx(struct io_uring_task *tctx);
	15	+void io_uring_free_tctx(struct task_struct *tsk);
15	16
16	17	void io_uring_unreg_ringfd(void);
17	18	int io_ringfd_register(struct io_ring_ctx ctx, void __user __arg,

io_uring/zcrx.c+2−1

@@ -808,7 +808,8 @@ err_xa_erase: · 807 unmodified lines
808	808	scoped_guard(mutex, &ctx->mmap_lock)
809	809	xa_erase(&ctx->zcrx_ctxs, id);
810	810	err:
811		− zcrx_unregister(ifq, ctx);
	811	+ /* the import path never set the ->master_ctx ref, don't drop it */
	812	+ zcrx_unregister(ifq, NULL);
812	813	return ret;
813	814	}
814	815