Commit e347810e authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'io_uring-6.16-20250718' of git://git.kernel.dk/linux 

Pull io_uring fixes from Jens Axboe:

 - dmabug offset fix for zcrx

 - Fix for the POLLERR connect work around handling

* tag 'io_uring-6.16-20250718' of git://git.kernel.dk/linux:
  io_uring/poll: fix POLLERR handling
  io_uring/zcrx: disallow user selected dmabuf offset and size
parents e5ac8742 c7cafd5b

io_uring/net.c

+8 −4
Original line number Diff line number Diff line
@@ -1738,9 +1738,11 @@ int io_connect(struct io_kiocb *req, unsigned int issue_flags) 
	int ret;

	bool force_nonblock = issue_flags & IO_URING_F_NONBLOCK;



	if (unlikely(req->flags & REQ_F_FAIL)) {

		ret = -ECONNRESET;

		goto out;

	if (connect->in_progress) {

		struct poll_table_struct pt = { ._key = EPOLLERR };



		if (vfs_poll(req->file, &pt) & EPOLLERR)

			goto get_sock_err;

	}



	file_flags = force_nonblock ? O_NONBLOCK : 0;
@@ -1765,9 +1767,11 @@ int io_connect(struct io_kiocb *req, unsigned int issue_flags) 
		 * which means the previous result is good. For both of these,

		 * grab the sock_error() and use that for the completion.

		 */

		if (ret == -EBADFD || ret == -EISCONN)

		if (ret == -EBADFD || ret == -EISCONN) {

get_sock_err:

			ret = sock_error(sock_from_file(req->file)->sk);

		}

	}

	if (ret == -ERESTARTSYS)

		ret = -EINTR;

out:

io_uring/poll.c

+0 −2
Original line number Diff line number Diff line
@@ -273,8 +273,6 @@ static int io_poll_check_events(struct io_kiocb *req, io_tw_token_t tw) 
				return IOU_POLL_REISSUE;

			}

		}

		if (unlikely(req->cqe.res & EPOLLERR))

			req_set_fail(req);

		if (req->apoll_events & EPOLLONESHOT)

			return IOU_POLL_DONE;

io_uring/zcrx.c

+3 −1
Original line number Diff line number Diff line
@@ -76,6 +76,8 @@ static int io_import_dmabuf(struct io_zcrx_ifq *ifq, 
	int dmabuf_fd = area_reg->dmabuf_fd;

	int i, ret;



	if (off)

		return -EINVAL;

	if (WARN_ON_ONCE(!ifq->dev))

		return -EFAULT;

	if (!IS_ENABLED(CONFIG_DMA_SHARED_BUFFER))
@@ -106,7 +108,7 @@ static int io_import_dmabuf(struct io_zcrx_ifq *ifq, 
	for_each_sgtable_dma_sg(mem->sgt, sg, i)

		total_size += sg_dma_len(sg);



	if (total_size < off + len) {

	if (total_size != len) {

		ret = -EINVAL;

		goto err;

	}