Commit 7907f673 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'io_uring-6.19-20260122' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux 

Pull io_uring fixes from Jens Axboe:

 - Fix for a potential leak of an iovec, if a specific cleanup path is
   used and the rw_cache is full at the time of the call

 - Fix for a regression added in this cycle, where waitid should be
   using prober release/acquire semantics for updating the wait queue
   head

 - Check for the cancelation bit being set for every work item processed
   by io-wq, not just at the start of the loop. Has no real practical
   implications other than to shut up syzbot doing crazy things that
   grossly overload a system, hence slowing down ring exit

 - A few selftest additions, updating the mini_liburing that selftests
   use

* tag 'io_uring-6.19-20260122' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  selftests/io_uring: support NO_SQARRAY in miniliburing
  selftests/io_uring: add io_uring_queue_init_params
  io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop
  io_uring/waitid: fix KCSAN warning on io_waitid->head
  io_uring/rw: free potentially allocated iovec on cache put failure
parents b33d7062 145e0074

io_uring/io-wq.c

+1 −1
Original line number Diff line number Diff line
@@ -598,9 +598,9 @@ static void io_worker_handle_work(struct io_wq_acct *acct, 
	__releases(&acct->lock)

{

	struct io_wq *wq = worker->wq;

	bool do_kill = test_bit(IO_WQ_BIT_EXIT, &wq->state);



	do {

		bool do_kill = test_bit(IO_WQ_BIT_EXIT, &wq->state);

		struct io_wq_work *work;



		/*

io_uring/rw.c

+11 −4
Original line number Diff line number Diff line
@@ -144,19 +144,22 @@ static inline int io_import_rw_buffer(int rw, struct io_kiocb *req, 
	return 0;

}



static void io_rw_recycle(struct io_kiocb *req, unsigned int issue_flags)

static bool io_rw_recycle(struct io_kiocb *req, unsigned int issue_flags)

{

	struct io_async_rw *rw = req->async_data;



	if (unlikely(issue_flags & IO_URING_F_UNLOCKED))

		return;

		return false;



	io_alloc_cache_vec_kasan(&rw->vec);

	if (rw->vec.nr > IO_VEC_CACHE_SOFT_CAP)

		io_vec_free(&rw->vec);



	if (io_alloc_cache_put(&req->ctx->rw_cache, rw))

	if (io_alloc_cache_put(&req->ctx->rw_cache, rw)) {

		io_req_async_data_clear(req, 0);

		return true;

	}

	return false;

}



static void io_req_rw_cleanup(struct io_kiocb *req, unsigned int issue_flags)
@@ -190,7 +193,11 @@ static void io_req_rw_cleanup(struct io_kiocb *req, unsigned int issue_flags) 
	 */

	if (!(req->flags & (REQ_F_REISSUE | REQ_F_REFCOUNT))) {

		req->flags &= ~REQ_F_NEED_CLEANUP;

		io_rw_recycle(req, issue_flags);

		if (!io_rw_recycle(req, issue_flags)) {

			struct io_async_rw *rw = req->async_data;



			io_vec_free(&rw->vec);

		}

	}

}

io_uring/waitid.c

+3 −3
Original line number Diff line number Diff line
@@ -114,11 +114,11 @@ static void io_waitid_remove_wq(struct io_kiocb *req) 
	struct io_waitid *iw = io_kiocb_to_cmd(req, struct io_waitid);

	struct wait_queue_head *head;



	head = READ_ONCE(iw->head);

	head = smp_load_acquire(&iw->head);

	if (head) {

		struct io_waitid_async *iwa = req->async_data;



		iw->head = NULL;

		smp_store_release(&iw->head, NULL);

		spin_lock_irq(&head->lock);

		list_del_init(&iwa->wo.child_wait.entry);

		spin_unlock_irq(&head->lock);
@@ -246,7 +246,7 @@ static int io_waitid_wait(struct wait_queue_entry *wait, unsigned mode, 
		return 0;



	list_del_init(&wait->entry);

	iw->head = NULL;

	smp_store_release(&iw->head, NULL);



	/* cancel is in progress */

	if (atomic_fetch_inc(&iw->refs) & IO_WAITID_REF_MASK)

tools/include/io_uring/mini_liburing.h

+44 −15
Original line number Diff line number Diff line
@@ -6,6 +6,7 @@ 
#include <stdio.h>

#include <string.h>

#include <unistd.h>

#include <sys/uio.h>



struct io_sq_ring {

	unsigned int *head;
@@ -55,6 +56,7 @@ struct io_uring { 
	struct io_uring_sq sq;

	struct io_uring_cq cq;

	int ring_fd;

	unsigned flags;

};



#if defined(__x86_64) || defined(__i386__)
@@ -72,7 +74,14 @@ static inline int io_uring_mmap(int fd, struct io_uring_params *p, 
	void *ptr;

	int ret;



	sq->ring_sz = p->sq_off.array + p->sq_entries * sizeof(unsigned int);

	if (p->flags & IORING_SETUP_NO_SQARRAY) {

		sq->ring_sz = p->cq_off.cqes;

		sq->ring_sz += p->cq_entries * sizeof(struct io_uring_cqe);

	} else {

		sq->ring_sz = p->sq_off.array;

		sq->ring_sz += p->sq_entries * sizeof(unsigned int);

	}



	ptr = mmap(0, sq->ring_sz, PROT_READ | PROT_WRITE,

		   MAP_SHARED | MAP_POPULATE, fd, IORING_OFF_SQ_RING);

	if (ptr == MAP_FAILED)
@@ -83,6 +92,7 @@ static inline int io_uring_mmap(int fd, struct io_uring_params *p, 
	sq->kring_entries = ptr + p->sq_off.ring_entries;

	sq->kflags = ptr + p->sq_off.flags;

	sq->kdropped = ptr + p->sq_off.dropped;

	if (!(p->flags & IORING_SETUP_NO_SQARRAY))

		sq->array = ptr + p->sq_off.array;



	size = p->sq_entries * sizeof(struct io_uring_sqe);
@@ -126,28 +136,39 @@ static inline int io_uring_enter(int fd, unsigned int to_submit, 
		       flags, sig, _NSIG / 8);

}



static inline int io_uring_queue_init(unsigned int entries,

static inline int io_uring_queue_init_params(unsigned int entries,

					     struct io_uring *ring,

				      unsigned int flags)

					     struct io_uring_params *p)

{

	struct io_uring_params p;

	int fd, ret;



	memset(ring, 0, sizeof(*ring));

	memset(&p, 0, sizeof(p));

	p.flags = flags;



	fd = io_uring_setup(entries, &p);

	fd = io_uring_setup(entries, p);

	if (fd < 0)

		return fd;

	ret = io_uring_mmap(fd, &p, &ring->sq, &ring->cq);

	if (!ret)

	ret = io_uring_mmap(fd, p, &ring->sq, &ring->cq);

	if (!ret) {

		ring->ring_fd = fd;

	else

		ring->flags = p->flags;

	} else {

		close(fd);

	}

	return ret;

}



static inline int io_uring_queue_init(unsigned int entries,

				      struct io_uring *ring,

				      unsigned int flags)

{

	struct io_uring_params p;



	memset(&p, 0, sizeof(p));

	p.flags = flags;



	return io_uring_queue_init_params(entries, ring, &p);

}



/* Get a sqe */

static inline struct io_uring_sqe *io_uring_get_sqe(struct io_uring *ring)

{
@@ -199,10 +220,18 @@ static inline int io_uring_submit(struct io_uring *ring) 


	ktail = *sq->ktail;

	to_submit = sq->sqe_tail - sq->sqe_head;



	if (!(ring->flags & IORING_SETUP_NO_SQARRAY)) {

		for (submitted = 0; submitted < to_submit; submitted++) {

			read_barrier();

			sq->array[ktail++ & mask] = sq->sqe_head++ & mask;

		}

	} else {

		ktail += to_submit;

		sq->sqe_head += to_submit;

		submitted = to_submit;

	}



	if (!submitted)

		return 0;