Commit 9223e74f authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'io_uring-5.10-2020-11-27' of git://git.kernel.dk/linux-block 

Pull io_uring fixes from Jens Axboe:

 - Out of bounds fix for the cq size cap from earlier this release (Joseph)

 - iov_iter type check fix (Pavel)

 - Files grab + cancelation fix (Pavel)

* tag 'io_uring-5.10-2020-11-27' of git://git.kernel.dk/linux-block:
  io_uring: fix files grab/cancel race
  io_uring: fix ITER_BVEC check
  io_uring: fix shift-out-of-bounds when round up cq size
parents d021c3e5 af604703

fs/io_uring.c

+20 −19
Original line number Diff line number Diff line
@@ -1313,22 +1313,6 @@ static bool io_grab_identity(struct io_kiocb *req) 
			return false;

		req->work.flags |= IO_WQ_WORK_FSIZE;

	}



	if (!(req->work.flags & IO_WQ_WORK_FILES) &&

	    (def->work_flags & IO_WQ_WORK_FILES) &&

	    !(req->flags & REQ_F_NO_FILE_TABLE)) {

		if (id->files != current->files ||

		    id->nsproxy != current->nsproxy)

			return false;

		atomic_inc(&id->files->count);

		get_nsproxy(id->nsproxy);

		req->flags |= REQ_F_INFLIGHT;



		spin_lock_irq(&ctx->inflight_lock);

		list_add(&req->inflight_entry, &ctx->inflight_list);

		spin_unlock_irq(&ctx->inflight_lock);

		req->work.flags |= IO_WQ_WORK_FILES;

	}

#ifdef CONFIG_BLK_CGROUP

	if (!(req->work.flags & IO_WQ_WORK_BLKCG) &&

	    (def->work_flags & IO_WQ_WORK_BLKCG)) {
@@ -1370,6 +1354,21 @@ static bool io_grab_identity(struct io_kiocb *req) 
		}

		spin_unlock(&current->fs->lock);

	}

	if (!(req->work.flags & IO_WQ_WORK_FILES) &&

	    (def->work_flags & IO_WQ_WORK_FILES) &&

	    !(req->flags & REQ_F_NO_FILE_TABLE)) {

		if (id->files != current->files ||

		    id->nsproxy != current->nsproxy)

			return false;

		atomic_inc(&id->files->count);

		get_nsproxy(id->nsproxy);

		req->flags |= REQ_F_INFLIGHT;



		spin_lock_irq(&ctx->inflight_lock);

		list_add(&req->inflight_entry, &ctx->inflight_list);

		spin_unlock_irq(&ctx->inflight_lock);

		req->work.flags |= IO_WQ_WORK_FILES;

	}



	return true;

}
@@ -3193,7 +3192,7 @@ static void io_req_map_rw(struct io_kiocb *req, const struct iovec *iovec, 
	rw->free_iovec = iovec;

	rw->bytes_done = 0;

	/* can only be fixed buffers, no need to do anything */

	if (iter->type == ITER_BVEC)

	if (iov_iter_is_bvec(iter))

		return;

	if (!iovec) {

		unsigned iov_off = 0;
@@ -9252,14 +9251,16 @@ static int io_uring_create(unsigned entries, struct io_uring_params *p, 
		 * to a power-of-two, if it isn't already. We do NOT impose

		 * any cq vs sq ring sizing.

		 */

		p->cq_entries = roundup_pow_of_two(p->cq_entries);

		if (p->cq_entries < p->sq_entries)

		if (!p->cq_entries)

			return -EINVAL;

		if (p->cq_entries > IORING_MAX_CQ_ENTRIES) {

			if (!(p->flags & IORING_SETUP_CLAMP))

				return -EINVAL;

			p->cq_entries = IORING_MAX_CQ_ENTRIES;

		}

		p->cq_entries = roundup_pow_of_two(p->cq_entries);

		if (p->cq_entries < p->sq_entries)

			return -EINVAL;

	} else {

		p->cq_entries = 2 * p->sq_entries;

	}

CRA Git | Maintained and supported by SUSTech CRA and CCSE