tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge tag 'io_uring-5.13-2021-05-07' of git://git.kernel.dk/linux-block

Pull io_uring fixes from Jens Axboe:
"Mostly fixes for merge window merged code. In detail:

- Error case memory leak fixes (Colin, Zqiang)

- Add the tools/io_uring/ to the list of maintained files (Lukas)

- Set of fixes for the modified buffer registration API (Pavel)

- Sanitize io thread setup on x86 (Stefan)

- Ensure we truncate transfer count for registered buffers (Thadeu)"

* tag 'io_uring-5.13-2021-05-07' of git://git.kernel.dk/linux-block:
x86/process: setup io_threads more like normal user space threads
MAINTAINERS: add io_uring tool to IO_URING
io_uring: truncate lengths larger than MAX_RW_COUNT on provide buffers
io_uring: Fix memory leak in io_sqe_buffers_register()
io_uring: Fix premature return from loop and memory leak
io_uring: fix unchecked error in switch_start()
io_uring: allow empty slots for reg buffers
io_uring: add more build check for uapi
io_uring: dont overlap internal and user req flags
io_uring: fix drain with rsrc CQEs

Linus Torvalds 28b4afeb a647034f

+70 -19
+1
MAINTAINERS
··· 9552 9552 F: fs/io_uring.c 9553 9553 F: include/linux/io_uring.h 9554 9554 F: include/uapi/linux/io_uring.h 9555 + F: tools/io_uring/ 9555 9556 9556 9557 IPMI SUBSYSTEM 9557 9558 M: Corey Minyard <minyard@acm.org>
+18 -1
arch/x86/kernel/process.c
··· 156 156 #endif 157 157 158 158 /* Kernel thread ? */ 159 - if (unlikely(p->flags & (PF_KTHREAD | PF_IO_WORKER))) { 159 + if (unlikely(p->flags & PF_KTHREAD)) { 160 160 memset(childregs, 0, sizeof(struct pt_regs)); 161 161 kthread_frame_init(frame, sp, arg); 162 162 return 0; ··· 171 171 #ifdef CONFIG_X86_32 172 172 task_user_gs(p) = get_user_gs(current_pt_regs()); 173 173 #endif 174 + 175 + if (unlikely(p->flags & PF_IO_WORKER)) { 176 + /* 177 + * An IO thread is a user space thread, but it doesn't 178 + * return to ret_after_fork(). 179 + * 180 + * In order to indicate that to tools like gdb, 181 + * we reset the stack and instruction pointers. 182 + * 183 + * It does the same kernel frame setup to return to a kernel 184 + * function that a kernel thread does. 185 + */ 186 + childregs->sp = 0; 187 + childregs->ip = 0; 188 + kthread_frame_init(frame, sp, arg); 189 + return 0; 190 + } 174 191 175 192 /* Set a new TLS for the child thread? */ 176 193 if (clone_flags & CLONE_SETTLS)
+51 -18
fs/io_uring.c
··· 251 251 struct io_buffer { 252 252 struct list_head list; 253 253 __u64 addr; 254 - __s32 len; 254 + __u32 len; 255 255 __u16 bid; 256 256 }; 257 257 ··· 456 456 spinlock_t rsrc_ref_lock; 457 457 struct io_rsrc_node *rsrc_node; 458 458 struct io_rsrc_node *rsrc_backup_node; 459 + struct io_mapped_ubuf *dummy_ubuf; 459 460 460 461 struct io_restriction restrictions; 461 462 ··· 703 702 REQ_F_FORCE_ASYNC_BIT = IOSQE_ASYNC_BIT, 704 703 REQ_F_BUFFER_SELECT_BIT = IOSQE_BUFFER_SELECT_BIT, 705 704 706 - REQ_F_FAIL_LINK_BIT, 705 + /* first byte is taken by user flags, shift it to not overlap */ 706 + REQ_F_FAIL_LINK_BIT = 8, 707 707 REQ_F_INFLIGHT_BIT, 708 708 REQ_F_CUR_POS_BIT, 709 709 REQ_F_NOWAIT_BIT, ··· 1159 1157 goto err; 1160 1158 __hash_init(ctx->cancel_hash, 1U << hash_bits); 1161 1159 1160 + ctx->dummy_ubuf = kzalloc(sizeof(*ctx->dummy_ubuf), GFP_KERNEL); 1161 + if (!ctx->dummy_ubuf) 1162 + goto err; 1163 + /* set invalid range, so io_import_fixed() fails meeting it */ 1164 + ctx->dummy_ubuf->ubuf = -1UL; 1165 + 1162 1166 if (percpu_ref_init(&ctx->refs, io_ring_ctx_ref_free, 1163 1167 PERCPU_REF_ALLOW_REINIT, GFP_KERNEL)) 1164 1168 goto err; ··· 1192 1184 INIT_LIST_HEAD(&ctx->submit_state.comp.locked_free_list); 1193 1185 return ctx; 1194 1186 err: 1187 + kfree(ctx->dummy_ubuf); 1195 1188 kfree(ctx->cancel_hash); 1196 1189 kfree(ctx); 1197 1190 return NULL; ··· 3986 3977 break; 3987 3978 3988 3979 buf->addr = addr; 3989 - buf->len = pbuf->len; 3980 + buf->len = min_t(__u32, pbuf->len, MAX_RW_COUNT); 3990 3981 buf->bid = bid; 3991 3982 addr += pbuf->len; 3992 3983 bid++; ··· 6512 6503 req->work.creds = NULL; 6513 6504 6514 6505 /* enforce forwards compatibility on users */ 6515 - if (unlikely(sqe_flags & ~SQE_VALID_FLAGS)) { 6516 - req->flags = 0; 6506 + if (unlikely(sqe_flags & ~SQE_VALID_FLAGS)) 6517 6507 return -EINVAL; 6518 - } 6519 - 6520 6508 if (unlikely(req->opcode >= IORING_OP_LAST)) 6521 6509 return -EINVAL; 6522 - 6523 6510 if (unlikely(!io_check_restriction(ctx, req, sqe_flags))) 6524 6511 return -EACCES; 6525 6512 ··· 7544 7539 io_ring_submit_lock(ctx, lock_ring); 7545 7540 spin_lock_irqsave(&ctx->completion_lock, flags); 7546 7541 io_cqring_fill_event(ctx, prsrc->tag, 0, 0); 7542 + ctx->cq_extra++; 7547 7543 io_commit_cqring(ctx); 7548 7544 spin_unlock_irqrestore(&ctx->completion_lock, flags); 7549 7545 io_cqring_ev_posted(ctx); ··· 8117 8111 struct io_mapped_ubuf *imu = *slot; 8118 8112 unsigned int i; 8119 8113 8120 - for (i = 0; i < imu->nr_bvecs; i++) 8121 - unpin_user_page(imu->bvec[i].bv_page); 8122 - if (imu->acct_pages) 8123 - io_unaccount_mem(ctx, imu->acct_pages); 8124 - kvfree(imu); 8114 + if (imu != ctx->dummy_ubuf) { 8115 + for (i = 0; i < imu->nr_bvecs; i++) 8116 + unpin_user_page(imu->bvec[i].bv_page); 8117 + if (imu->acct_pages) 8118 + io_unaccount_mem(ctx, imu->acct_pages); 8119 + kvfree(imu); 8120 + } 8125 8121 *slot = NULL; 8126 8122 } 8127 8123 ··· 8140 8132 for (i = 0; i < ctx->nr_user_bufs; i++) 8141 8133 io_buffer_unmap(ctx, &ctx->user_bufs[i]); 8142 8134 kfree(ctx->user_bufs); 8143 - kfree(ctx->buf_data); 8135 + io_rsrc_data_free(ctx->buf_data); 8144 8136 ctx->user_bufs = NULL; 8145 8137 ctx->buf_data = NULL; 8146 8138 ctx->nr_user_bufs = 0; ··· 8263 8255 size_t size; 8264 8256 int ret, pret, nr_pages, i; 8265 8257 8258 + if (!iov->iov_base) { 8259 + *pimu = ctx->dummy_ubuf; 8260 + return 0; 8261 + } 8262 + 8266 8263 ubuf = (unsigned long) iov->iov_base; 8267 8264 end = (ubuf + iov->iov_len + PAGE_SIZE - 1) >> PAGE_SHIFT; 8268 8265 start = ubuf >> PAGE_SHIFT; ··· 8365 8352 * constraints here, we'll -EINVAL later when IO is 8366 8353 * submitted if they are wrong. 8367 8354 */ 8368 - if (!iov->iov_base || !iov->iov_len) 8355 + if (!iov->iov_base) 8356 + return iov->iov_len ? -EFAULT : 0; 8357 + if (!iov->iov_len) 8369 8358 return -EFAULT; 8370 8359 8371 8360 /* arbitrary limit, but we need something */ ··· 8400 8385 return -ENOMEM; 8401 8386 ret = io_buffers_map_alloc(ctx, nr_args); 8402 8387 if (ret) { 8403 - kfree(data); 8388 + io_rsrc_data_free(data); 8404 8389 return ret; 8405 8390 } 8406 8391 ··· 8417 8402 ret = io_buffer_validate(&iov); 8418 8403 if (ret) 8419 8404 break; 8405 + if (!iov.iov_base && tag) { 8406 + ret = -EINVAL; 8407 + break; 8408 + } 8420 8409 8421 8410 ret = io_sqe_buffer_register(ctx, &iov, &ctx->user_bufs[i], 8422 8411 &last_hpage); ··· 8470 8451 err = io_buffer_validate(&iov); 8471 8452 if (err) 8472 8453 break; 8454 + if (!iov.iov_base && tag) { 8455 + err = -EINVAL; 8456 + break; 8457 + } 8473 8458 err = io_sqe_buffer_register(ctx, &iov, &imu, &last_hpage); 8474 8459 if (err) 8475 8460 break; 8476 8461 8477 8462 i = array_index_nospec(offset, ctx->nr_user_bufs); 8478 - if (ctx->user_bufs[i]) { 8463 + if (ctx->user_bufs[i] != ctx->dummy_ubuf) { 8479 8464 err = io_queue_rsrc_removal(ctx->buf_data, offset, 8480 8465 ctx->rsrc_node, ctx->user_bufs[i]); 8481 8466 if (unlikely(err)) { ··· 8627 8604 if (ctx->hash_map) 8628 8605 io_wq_put_hash(ctx->hash_map); 8629 8606 kfree(ctx->cancel_hash); 8607 + kfree(ctx->dummy_ubuf); 8630 8608 kfree(ctx); 8631 8609 } 8632 8610 ··· 9631 9607 if (ret) 9632 9608 goto err; 9633 9609 /* always set a rsrc node */ 9634 - io_rsrc_node_switch_start(ctx); 9610 + ret = io_rsrc_node_switch_start(ctx); 9611 + if (ret) 9612 + goto err; 9635 9613 io_rsrc_node_switch(ctx, NULL); 9636 9614 9637 9615 memset(&p->sq_off, 0, sizeof(p->sq_off)); ··· 10161 10135 BUILD_BUG_SQE_ELEM(40, __u16, buf_index); 10162 10136 BUILD_BUG_SQE_ELEM(42, __u16, personality); 10163 10137 BUILD_BUG_SQE_ELEM(44, __s32, splice_fd_in); 10138 + 10139 + BUILD_BUG_ON(sizeof(struct io_uring_files_update) != 10140 + sizeof(struct io_uring_rsrc_update)); 10141 + BUILD_BUG_ON(sizeof(struct io_uring_rsrc_update) > 10142 + sizeof(struct io_uring_rsrc_update2)); 10143 + /* should fit into one byte */ 10144 + BUILD_BUG_ON(SQE_VALID_FLAGS >= (1 << 8)); 10164 10145 10165 10146 BUILD_BUG_ON(ARRAY_SIZE(io_op_defs) != IORING_OP_LAST); 10166 10147 BUILD_BUG_ON(__REQ_F_LAST_BIT >= 8 * sizeof(int));