Commit f9d66e64 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'io_uring-20260221' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux 

Pull io_uring fixes from Jens Axboe:

 - A fix for a missing URING_CMD128 opcode check, fixing an issue with
   the SQE mixed mode support introduced in 6.19. Merged late due to
   having multiple dependencies

 - Add sqe->cmd size checking for big SQEs, similar to what we have for
   normal sized SQEs

 - Fix a race condition in zcrx, that leads to a double free

* tag 'io_uring-20260221' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  io_uring: Add size check for sqe->cmd
  io_uring: add IORING_OP_URING_CMD128 to opcode checks
  io_uring/zcrx: fix user_ref race between scrub and refill paths
parents 817c16e5 ea129e55

drivers/block/ublk_drv.c

+8 −4
Original line number Diff line number Diff line
@@ -3255,7 +3255,8 @@ static int ublk_ch_uring_cmd_local(struct io_uring_cmd *cmd, 
		unsigned int issue_flags)

{

	/* May point to userspace-mapped memory */

	const struct ublksrv_io_cmd *ub_src = io_uring_sqe_cmd(cmd->sqe);

	const struct ublksrv_io_cmd *ub_src = io_uring_sqe_cmd(cmd->sqe,

							       struct ublksrv_io_cmd);

	u16 buf_idx = UBLK_INVALID_BUF_IDX;

	struct ublk_device *ub = cmd->file->private_data;

	struct ublk_queue *ubq;
@@ -3833,7 +3834,8 @@ static int ublk_validate_batch_fetch_cmd(struct ublk_batch_io_data *data) 
static int ublk_handle_non_batch_cmd(struct io_uring_cmd *cmd,

				     unsigned int issue_flags)

{

	const struct ublksrv_io_cmd *ub_cmd = io_uring_sqe_cmd(cmd->sqe);

	const struct ublksrv_io_cmd *ub_cmd = io_uring_sqe_cmd(cmd->sqe,

							       struct ublksrv_io_cmd);

	struct ublk_device *ub = cmd->file->private_data;

	unsigned tag = READ_ONCE(ub_cmd->tag);

	unsigned q_id = READ_ONCE(ub_cmd->q_id);
@@ -3862,7 +3864,8 @@ static int ublk_handle_non_batch_cmd(struct io_uring_cmd *cmd, 
static int ublk_ch_batch_io_uring_cmd(struct io_uring_cmd *cmd,

				       unsigned int issue_flags)

{

	const struct ublk_batch_io *uc = io_uring_sqe_cmd(cmd->sqe);

	const struct ublk_batch_io *uc = io_uring_sqe_cmd(cmd->sqe,

							  struct ublk_batch_io);

	struct ublk_device *ub = cmd->file->private_data;

	struct ublk_batch_io_data data = {

		.ub  = ub,
@@ -5253,7 +5256,8 @@ static int ublk_ctrl_uring_cmd(struct io_uring_cmd *cmd, 
		unsigned int issue_flags)

{

	/* May point to userspace-mapped memory */

	const struct ublksrv_ctrl_cmd *ub_src = io_uring_sqe_cmd(cmd->sqe);

	const struct ublksrv_ctrl_cmd *ub_src = io_uring_sqe128_cmd(cmd->sqe,

								    struct ublksrv_ctrl_cmd);

	struct ublksrv_ctrl_cmd header;

	struct ublk_device *ub = NULL;

	u32 cmd_op = cmd->cmd_op;

drivers/nvme/host/ioctl.c

+2 −1
Original line number Diff line number Diff line
@@ -447,7 +447,8 @@ static int nvme_uring_cmd_io(struct nvme_ctrl *ctrl, struct nvme_ns *ns, 
		struct io_uring_cmd *ioucmd, unsigned int issue_flags, bool vec)

{

	struct nvme_uring_cmd_pdu *pdu = nvme_uring_cmd_pdu(ioucmd);

	const struct nvme_uring_cmd *cmd = io_uring_sqe_cmd(ioucmd->sqe);

	const struct nvme_uring_cmd *cmd = io_uring_sqe128_cmd(ioucmd->sqe,

							       struct nvme_uring_cmd);

	struct request_queue *q = ns ? ns->queue : ctrl->admin_q;

	struct nvme_uring_data d;

	struct nvme_command c;

fs/fuse/dev_uring.c

+4 −2
Original line number Diff line number Diff line
@@ -879,7 +879,8 @@ static int fuse_ring_ent_set_commit(struct fuse_ring_ent *ent) 
static int fuse_uring_commit_fetch(struct io_uring_cmd *cmd, int issue_flags,

				   struct fuse_conn *fc)

{

	const struct fuse_uring_cmd_req *cmd_req = io_uring_sqe_cmd(cmd->sqe);

	const struct fuse_uring_cmd_req *cmd_req = io_uring_sqe128_cmd(cmd->sqe,

								       struct fuse_uring_cmd_req);

	struct fuse_ring_ent *ent;

	int err;

	struct fuse_ring *ring = fc->ring;
@@ -1083,7 +1084,8 @@ fuse_uring_create_ring_ent(struct io_uring_cmd *cmd, 
static int fuse_uring_register(struct io_uring_cmd *cmd,

			       unsigned int issue_flags, struct fuse_conn *fc)

{

	const struct fuse_uring_cmd_req *cmd_req = io_uring_sqe_cmd(cmd->sqe);

	const struct fuse_uring_cmd_req *cmd_req = io_uring_sqe128_cmd(cmd->sqe,

								       struct fuse_uring_cmd_req);

	struct fuse_ring *ring = smp_load_acquire(&fc->ring);

	struct fuse_ring_queue *queue;

	struct fuse_ring_ent *ent;

include/linux/io_uring/cmd.h

+11 −4
Original line number Diff line number Diff line
@@ -20,10 +20,17 @@ struct io_uring_cmd { 
	u8		unused[8];

};



static inline const void *io_uring_sqe_cmd(const struct io_uring_sqe *sqe)

{

	return sqe->cmd;

}

#define io_uring_sqe128_cmd(sqe, type)	({					\

	BUILD_BUG_ON(sizeof(type) > ((2 * sizeof(struct io_uring_sqe)) -	\

				     offsetof(struct io_uring_sqe, cmd)));	\

	(const type *)(sqe)->cmd;						\

})



#define io_uring_sqe_cmd(sqe, type)	({					\

	BUILD_BUG_ON(sizeof(type) > (sizeof(struct io_uring_sqe) -		\

				     offsetof(struct io_uring_sqe, cmd)));	\

	(const type *)(sqe)->cmd;						\

})



static inline void io_uring_cmd_private_sz_check(size_t cmd_sz)

{

io_uring/io_uring.h

+6 −0
Original line number Diff line number Diff line
@@ -530,6 +530,12 @@ static inline bool io_file_can_poll(struct io_kiocb *req) 
	return false;

}



static inline bool io_is_uring_cmd(const struct io_kiocb *req)

{

	return req->opcode == IORING_OP_URING_CMD ||

	       req->opcode == IORING_OP_URING_CMD128;

}



static inline ktime_t io_get_time(struct io_ring_ctx *ctx)

{

	if (ctx->clockid == CLOCK_MONOTONIC)