Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'io_uring-5.13-2021-05-14' of git://git.kernel.dk/linux-block
Pull io_uring fixes from Jens Axboe:
"Just a few minor fixes/changes:
- Fix issue with double free race for linked timeout completions
- Fix reference issue with timeouts
- Remove last few places that make SQPOLL special, since it's just an
io thread now.
- Bump maximum allowed registered buffers, as we don't allocate as
much anymore"
* tag 'io_uring-5.13-2021-05-14' of git://git.kernel.dk/linux-block:
io_uring: increase max number of reg buffers
io_uring: further remove sqpoll limits on opcodes
io_uring: fix ltout double free on completion race
io_uring: fix link timeout refs
+10
-9
+10
-9
fs/io_uring.c
+10
-9
fs/io_uring.c
···
100
100
#define IORING_MAX_RESTRICTIONS (IORING_RESTRICTION_LAST + \
101
101
IORING_REGISTER_LAST + IORING_OP_LAST)
102
102
103
+
#define IORING_MAX_REG_BUFFERS (1U << 14)
104
+
103
105
#define SQE_VALID_FLAGS (IOSQE_FIXED_FILE|IOSQE_IO_DRAIN|IOSQE_IO_LINK| \
104
106
IOSQE_IO_HARDLINK | IOSQE_ASYNC | \
105
107
IOSQE_BUFFER_SELECT)
···
4037
4035
#if defined(CONFIG_EPOLL)
4038
4036
if (sqe->ioprio || sqe->buf_index)
4039
4037
return -EINVAL;
4040
-
if (unlikely(req->ctx->flags & (IORING_SETUP_IOPOLL | IORING_SETUP_SQPOLL)))
4038
+
if (unlikely(req->ctx->flags & IORING_SETUP_IOPOLL))
4041
4039
return -EINVAL;
4042
4040
4043
4041
req->epoll.epfd = READ_ONCE(sqe->fd);
···
4152
4150
4153
4151
static int io_statx_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
4154
4152
{
4155
-
if (unlikely(req->ctx->flags & (IORING_SETUP_IOPOLL | IORING_SETUP_SQPOLL)))
4153
+
if (unlikely(req->ctx->flags & IORING_SETUP_IOPOLL))
4156
4154
return -EINVAL;
4157
4155
if (sqe->ioprio || sqe->buf_index)
4158
4156
return -EINVAL;
···
5829
5827
static int io_rsrc_update_prep(struct io_kiocb *req,
5830
5828
const struct io_uring_sqe *sqe)
5831
5829
{
5832
-
if (unlikely(req->ctx->flags & IORING_SETUP_SQPOLL))
5833
-
return -EINVAL;
5834
5830
if (unlikely(req->flags & (REQ_F_FIXED_FILE | REQ_F_BUFFER_SELECT)))
5835
5831
return -EINVAL;
5836
5832
if (sqe->ioprio || sqe->rw_flags)
···
6354
6354
* We don't expect the list to be empty, that will only happen if we
6355
6355
* race with the completion of the linked work.
6356
6356
*/
6357
-
if (prev && req_ref_inc_not_zero(prev))
6357
+
if (prev) {
6358
6358
io_remove_next_linked(prev);
6359
-
else
6360
-
prev = NULL;
6359
+
if (!req_ref_inc_not_zero(prev))
6360
+
prev = NULL;
6361
+
}
6361
6362
spin_unlock_irqrestore(&ctx->completion_lock, flags);
6362
6363
6363
6364
if (prev) {
6364
6365
io_async_find_and_cancel(ctx, req, prev->user_data, -ETIME);
6365
6366
io_put_req_deferred(prev, 1);
6367
+
io_put_req_deferred(req, 1);
6366
6368
} else {
6367
6369
io_req_complete_post(req, -ETIME, 0);
6368
6370
}
6369
-
io_put_req_deferred(req, 1);
6370
6371
return HRTIMER_NORESTART;
6371
6372
}
6372
6373
···
8391
8390
8392
8391
if (ctx->user_bufs)
8393
8392
return -EBUSY;
8394
-
if (!nr_args || nr_args > UIO_MAXIOV)
8393
+
if (!nr_args || nr_args > IORING_MAX_REG_BUFFERS)
8395
8394
return -EINVAL;
8396
8395
ret = io_rsrc_node_switch_start(ctx);
8397
8396
if (ret)