Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'io_uring-6.4-2023-06-21' of git://git.kernel.dk/linux
Pull io_uring fixes from Jens Axboe:
"A fix for a race condition with poll removal and linked timeouts, and
then a few followup fixes/tweaks for the msg_control patch from last
week.
Not super important, particularly the sparse fixup, as it was broken
before that recent commit. But let's get it sorted for real for this
release, rather than just have it broken a bit differently"
* tag 'io_uring-6.4-2023-06-21' of git://git.kernel.dk/linux:
io_uring/net: use the correct msghdr union member in io_sendmsg_copy_hdr
io_uring/net: disable partial retries for recvmsg with cmsg
io_uring/net: clear msg_controllen on partial sendmsg retry
io_uring/poll: serialize poll linked timer start with poll removal
+15
-11
+11
-6
io_uring/net.c
+11
-6
io_uring/net.c
···
203
203
ret = sendmsg_copy_msghdr(&iomsg->msg, sr->umsg, sr->msg_flags,
204
204
&iomsg->free_iov);
205
205
/* save msg_control as sys_sendmsg() overwrites it */
206
-
sr->msg_control = iomsg->msg.msg_control;
206
+
sr->msg_control = iomsg->msg.msg_control_user;
207
207
return ret;
208
208
}
209
209
···
302
302
303
303
if (req_has_async_data(req)) {
304
304
kmsg = req->async_data;
305
-
kmsg->msg.msg_control = sr->msg_control;
305
+
kmsg->msg.msg_control_user = sr->msg_control;
306
306
} else {
307
307
ret = io_sendmsg_copy_hdr(req, &iomsg);
308
308
if (ret)
···
326
326
if (ret == -EAGAIN && (issue_flags & IO_URING_F_NONBLOCK))
327
327
return io_setup_async_msg(req, kmsg, issue_flags);
328
328
if (ret > 0 && io_net_retry(sock, flags)) {
329
+
kmsg->msg.msg_controllen = 0;
330
+
kmsg->msg.msg_control = NULL;
329
331
sr->done_io += ret;
330
332
req->flags |= REQ_F_PARTIAL_IO;
331
333
return io_setup_async_msg(req, kmsg, issue_flags);
···
789
787
flags = sr->msg_flags;
790
788
if (force_nonblock)
791
789
flags |= MSG_DONTWAIT;
792
-
if (flags & MSG_WAITALL)
793
-
min_ret = iov_iter_count(&kmsg->msg.msg_iter);
794
790
795
791
kmsg->msg.msg_get_inq = 1;
796
-
if (req->flags & REQ_F_APOLL_MULTISHOT)
792
+
if (req->flags & REQ_F_APOLL_MULTISHOT) {
797
793
ret = io_recvmsg_multishot(sock, sr, kmsg, flags,
798
794
&mshot_finished);
799
-
else
795
+
} else {
796
+
/* disable partial retry for recvmsg with cmsg attached */
797
+
if (flags & MSG_WAITALL && !kmsg->msg.msg_controllen)
798
+
min_ret = iov_iter_count(&kmsg->msg.msg_iter);
799
+
800
800
ret = __sys_recvmsg_sock(sock, &kmsg->msg, sr->umsg,
801
801
kmsg->uaddr, flags);
802
+
}
802
803
803
804
if (ret < min_ret) {
804
805
if (ret == -EAGAIN && force_nonblock) {
+4
-5
io_uring/poll.c
+4
-5
io_uring/poll.c
···
977
977
struct io_hash_bucket *bucket;
978
978
struct io_kiocb *preq;
979
979
int ret2, ret = 0;
980
-
struct io_tw_state ts = {};
980
+
struct io_tw_state ts = { .locked = true };
981
981
982
+
io_ring_submit_lock(ctx, issue_flags);
982
983
preq = io_poll_find(ctx, true, &cd, &ctx->cancel_table, &bucket);
983
984
ret2 = io_poll_disarm(preq);
984
985
if (bucket)
···
991
990
goto out;
992
991
}
993
992
994
-
io_ring_submit_lock(ctx, issue_flags);
995
993
preq = io_poll_find(ctx, true, &cd, &ctx->cancel_table_locked, &bucket);
996
994
ret2 = io_poll_disarm(preq);
997
995
if (bucket)
998
996
spin_unlock(&bucket->lock);
999
-
io_ring_submit_unlock(ctx, issue_flags);
1000
997
if (ret2) {
1001
998
ret = ret2;
1002
999
goto out;
···
1018
1019
if (poll_update->update_user_data)
1019
1020
preq->cqe.user_data = poll_update->new_user_data;
1020
1021
1021
-
ret2 = io_poll_add(preq, issue_flags);
1022
+
ret2 = io_poll_add(preq, issue_flags & ~IO_URING_F_UNLOCKED);
1022
1023
/* successfully updated, don't complete poll request */
1023
1024
if (!ret2 || ret2 == -EIOCBQUEUED)
1024
1025
goto out;
···
1026
1027
1027
1028
req_set_fail(preq);
1028
1029
io_req_set_res(preq, -ECANCELED, 0);
1029
-
ts.locked = !(issue_flags & IO_URING_F_UNLOCKED);
1030
1030
io_req_task_complete(preq, &ts);
1031
1031
out:
1032
+
io_ring_submit_unlock(ctx, issue_flags);
1032
1033
if (ret < 0) {
1033
1034
req_set_fail(req);
1034
1035
return ret;