History

Merge tag 'io_uring-7.2-20260731' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

Pull io_uring fixes from Jens Axboe: - Fix for a bug in how length caps are handled in multishot, and along with it, a generic fix for avoiding these kinds of conversion issues in the future. - Ensure that task restrictions are always preserved across exec. - Revert of the io_uring controlled epoll restriction, which disallowed nested contexts. Turns out that libuv is already using it like that, so we cannot simply remove it, sadly. - Fix for a reference leak in the zcrx code. * tag 'io_uring-7.2-20260731' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring: preserve task restrictions across exec io_uring/zcrx: don't clear master_ctx from the import path Revert "io_uring/epoll: disallow adding an epoll file to an epoll context" io_uring/kbuf: cap buffer selection length at MAX_RW_COUNT io_uring/net: initialize mshot_len for send

Linus Torvalds committed 3 months ago

Commit 5d0c32d2 parents 680d49d bc0e8fa7 files · +15 −7Browse files

Unified · Split

7 files
  1. io_uring/cancel.c +1 −1
  2. io_uring/epoll.c +0 −3
  3. io_uring/kbuf.c +4 −1
  4. io_uring/net.c +1 −0
  5. io_uring/tctx.c +6 −1
  6. io_uring/tctx.h +1 −0
  7. io_uring/zcrx.c +2 −1
io_uring/cancel.c+1−1
@@ -660,6 +660,6 @@ end_wait: · 659 unmodified lines
660 */660 */
661 atomic_dec(&tctx->in_cancel);661 atomic_dec(&tctx->in_cancel);
662 /* for exec all current's requests should be gone, kill tctx */662 /* for exec all current's requests should be gone, kill tctx */
663 __io_uring_free(current);663 io_uring_free_tctx(current);
664 }664 }
665}665}
io_uring/epoll.c+0−3
@@ -62,9 +62,6 @@ int io_epoll_ctl(struct io_kiocb *req, unsigned int issue_flags) · 61 unmodified lines
62 CLASS(fd, tf)(ie->fd);62 CLASS(fd, tf)(ie->fd);
63 if (fd_empty(tf))63 if (fd_empty(tf))
64 return -EBADF;64 return -EBADF;
65 /* disallow adding an epoll context to another epoll context */
66 if (ie->op == EPOLL_CTL_ADD && is_file_epoll(fd_file(tf)))
67 return -EINVAL;
68 65
69 key.file = fd_file(tf);66 key.file = fd_file(tf);
70 key.fd = ie->fd;67 key.fd = ie->fd;
io_uring/kbuf.c+4−1
@@ -266,6 +266,9 @@ static int io_ring_buffers_peek(struct io_kiocb *req, struct buf_sel_arg *arg, · 265 unmodified lines
266 if (unlikely(!nr_avail))266 if (unlikely(!nr_avail))
267 return -ENOBUFS;267 return -ENOBUFS;
268 268
269 /* MAX_RW_COUNT is the universal Linux per-call IO maximum */
270 arg->max_len = min_t(size_t, arg->max_len, MAX_RW_COUNT);
271
269 buf = io_ring_head_to_buf(br, head, bl->mask);272 buf = io_ring_head_to_buf(br, head, bl->mask);
270 if (arg->max_len) {273 if (arg->max_len) {
271 u32 len = READ_ONCE(buf->len);274 u32 len = READ_ONCE(buf->len);
@@ -295,7 +298,7 @@ static int io_ring_buffers_peek(struct io_kiocb *req, struct buf_sel_arg *arg, · 23 unmodified lines
295 298
296 /* set it to max, if not set, so we can use it unconditionally */299 /* set it to max, if not set, so we can use it unconditionally */
297 if (!arg->max_len)300 if (!arg->max_len)
298 arg->max_len = INT_MAX;301 arg->max_len = MAX_RW_COUNT;
299 302
300 req->buf_index = READ_ONCE(buf->bid);303 req->buf_index = READ_ONCE(buf->bid);
301 do {304 do {
io_uring/net.c+1−0
@@ -445,6 +445,7 @@ int io_sendmsg_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) · 444 unmodified lines
445 req->flags |= REQ_F_NOWAIT;445 req->flags |= REQ_F_NOWAIT;
446 if (req->flags & REQ_F_BUFFER_SELECT)446 if (req->flags & REQ_F_BUFFER_SELECT)
447 sr->buf_group = req->buf_index;447 sr->buf_group = req->buf_index;
448 sr->mshot_total_len = sr->mshot_len = 0;
448 if (sr->flags & IORING_RECVSEND_BUNDLE) {449 if (sr->flags & IORING_RECVSEND_BUNDLE) {
449 if (req->opcode == IORING_OP_SENDMSG)450 if (req->opcode == IORING_OP_SENDMSG)
450 return -EINVAL;451 return -EINVAL;
io_uring/tctx.c+6−1
@@ -43,7 +43,7 @@ static struct io_wq *io_init_wq_offload(struct io_ring_ctx *ctx, · 42 unmodified lines
43 return io_wq_create(concurrency, &data);43 return io_wq_create(concurrency, &data);
44}44}
45 45
46void __io_uring_free(struct task_struct *tsk)46void io_uring_free_tctx(struct task_struct *tsk)
47{47{
48 struct io_uring_task *tctx = tsk->io_uring;48 struct io_uring_task *tctx = tsk->io_uring;
49 struct io_tctx_node *node;49 struct io_tctx_node *node;
@@ -67,6 +67,11 @@ void __io_uring_free(struct task_struct *tsk) · 17 unmodified lines
67 kfree(tctx);67 kfree(tctx);
68 tsk->io_uring = NULL;68 tsk->io_uring = NULL;
69 }69 }
70}
71
72void __io_uring_free(struct task_struct *tsk)
73{
74 io_uring_free_tctx(tsk);
70 if (tsk->io_uring_restrict) {75 if (tsk->io_uring_restrict) {
71 io_put_bpf_filters(tsk->io_uring_restrict);76 io_put_bpf_filters(tsk->io_uring_restrict);
72 kfree(tsk->io_uring_restrict);77 kfree(tsk->io_uring_restrict);
io_uring/tctx.h+1−0
@@ -12,6 +12,7 @@ void io_uring_del_tctx_node(unsigned long index); · 11 unmodified lines
12int __io_uring_add_tctx_node(struct io_ring_ctx *ctx);12int __io_uring_add_tctx_node(struct io_ring_ctx *ctx);
13int __io_uring_add_tctx_node_from_submit(struct io_ring_ctx *ctx);13int __io_uring_add_tctx_node_from_submit(struct io_ring_ctx *ctx);
14void io_uring_clean_tctx(struct io_uring_task *tctx);14void io_uring_clean_tctx(struct io_uring_task *tctx);
15void io_uring_free_tctx(struct task_struct *tsk);
15 16
16void io_uring_unreg_ringfd(void);17void io_uring_unreg_ringfd(void);
17int io_ringfd_register(struct io_ring_ctx *ctx, void __user *__arg,18int io_ringfd_register(struct io_ring_ctx *ctx, void __user *__arg,
io_uring/zcrx.c+2−1
@@ -808,7 +808,8 @@ err_xa_erase: · 807 unmodified lines
808 scoped_guard(mutex, &ctx->mmap_lock)808 scoped_guard(mutex, &ctx->mmap_lock)
809 xa_erase(&ctx->zcrx_ctxs, id);809 xa_erase(&ctx->zcrx_ctxs, id);
810err:810err:
811 zcrx_unregister(ifq, ctx);811 /* the import path never set the ->master_ctx ref, don't drop it */
812 zcrx_unregister(ifq, NULL);
812 return ret;813 return ret;
813}814}
814 815