tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge tag 'io_uring-6.12-20241018' of git://git.kernel.dk/linux

Pull io_uring fixes from Jens Axboe:

- Fix a regression this merge window where cloning of registered
buffers didn't take into account the dummy_ubuf

- Fix a race with reading how many SQRING entries are available,
causing userspace to need to loop around io_uring_sqring_wait()
rather than being able to rely on SQEs being available when it
returned

- Ensure that the SQPOLL thread is TASK_RUNNING before running
task_work off the cancelation exit path

* tag 'io_uring-6.12-20241018' of git://git.kernel.dk/linux:
io_uring/sqpoll: ensure task state is TASK_RUNNING when running task_work
io_uring/rsrc: ignore dummy_ubuf for buffer cloning
io_uring/sqpoll: close race on waiting for sqring entries

Linus Torvalds a041f478 b04ae0f4

+11 -2
+9 -1
io_uring/io_uring.h
··· 284 284 { 285 285 struct io_rings *r = ctx->rings; 286 286 287 - return READ_ONCE(r->sq.tail) - ctx->cached_sq_head == ctx->sq_entries; 287 + /* 288 + * SQPOLL must use the actual sqring head, as using the cached_sq_head 289 + * is race prone if the SQPOLL thread has grabbed entries but not yet 290 + * committed them to the ring. For !SQPOLL, this doesn't matter, but 291 + * since this helper is just used for SQPOLL sqring waits (or POLLOUT), 292 + * just read the actual sqring head unconditionally. 293 + */ 294 + return READ_ONCE(r->sq.tail) - READ_ONCE(r->sq.head) == ctx->sq_entries; 288 295 } 289 296 290 297 static inline unsigned int io_sqring_entries(struct io_ring_ctx *ctx) ··· 327 320 if (current->io_uring) { 328 321 unsigned int count = 0; 329 322 323 + __set_current_state(TASK_RUNNING); 330 324 tctx_task_work_run(current->io_uring, UINT_MAX, &count); 331 325 if (count) 332 326 ret = true;
+2 -1
io_uring/rsrc.c
··· 1176 1176 for (i = 0; i < nbufs; i++) { 1177 1177 struct io_mapped_ubuf *src = src_ctx->user_bufs[i]; 1178 1178 1179 - refcount_inc(&src->refs); 1179 + if (src != &dummy_ubuf) 1180 + refcount_inc(&src->refs); 1180 1181 user_bufs[i] = src; 1181 1182 } 1182 1183