linux.git/fs/io_uring.c, branch v5.4

io_uring: ensure registered buffer import returns the IO length

2019-11-13T23:15:14+00:00

A test case was reported where two linked reads with registered buffers
failed the second link always. This is because we set the expected value
of a request in req->result, and if we don't get this result, then we
fail the dependent links. For some reason the registered buffer import
returned -ERROR/0, while the normal import returns -ERROR/length. This
broke linked commands with registered buffers.

Fix this by making io_import_fixed() correctly return the mapped length.

Cc: stable@vger.kernel.org # v5.3
Reported-by: 李通洲 
Signed-off-by: Jens Axboe

io_uring: Fix getting file for timeout

2019-11-13T22:25:57+00:00

For timeout requests io_uring tries to grab a file with specified fd,
which is usually stdin/fd=0.
Update io_op_needs_file()

Signed-off-by: Pavel Begunkov 
Signed-off-by: Jens Axboe

io_uring: make timeout sequence == 0 mean no sequence

2019-11-12T07:18:51+00:00

Currently we make sequence == 0 be the same as sequence == 1, but that's
not super useful if the intent is really to have a timeout that's just
a pure timeout.

If the user passes in sqe->off == 0, then don't apply any sequence logic
to the request, let it purely be driven by the timeout specified.

Reported-by: 李通洲 
Reviewed-by: 李通洲 
Signed-off-by: Jens Axboe

io_uring: ensure we clear io_kiocb->result before each issue

2019-10-30T20:45:22+00:00

We use io_kiocb->result == -EAGAIN as a way to know if we need to
re-submit a polled request, as -EAGAIN reporting happens out-of-line
for IO submission failures. This field is cleared when we originally
allocate the request, but it isn't reset when we retry the submission
from async context. This can cause issues where we think something
needs a re-issue, but we're really just reading stale data.

Reset ->result whenever we re-prep a request for polled submission.

Cc: stable@vger.kernel.org
Fixes: 9e645e1105ca ("io_uring: add support for sqe links")
Reported-by: Bijan Mottahedeh 
Signed-off-by: Jens Axboe

io_uring: don't touch ctx in setup after ring fd install

2019-10-28T15:15:33+00:00

syzkaller reported an issue where it looks like a malicious app can
trigger a use-after-free of reading the ctx ->sq_array and ->rings
value right after having installed the ring fd in the process file
table.

Defer ring fd installation until after we're done reading those
values.

Fixes: 75b28affdd6a ("io_uring: allocate the two rings together")
Reported-by: syzbot+6f03d895a6cd0d06187f@syzkaller.appspotmail.com
Signed-off-by: Jens Axboe

io_uring: Fix leaked shadow_req

2019-10-28T03:29:18+00:00

io_queue_link_head() owns shadow_req after taking it as an argument.
By not freeing it in case of an error, it can leak the request along
with taken ctx->refs.

Reviewed-by: Jackie Liu 
Signed-off-by: Pavel Begunkov 
Signed-off-by: Jens Axboe

io_uring: fix bad inflight accounting for SETUP_IOPOLL|SETUP_SQTHREAD

2019-10-25T16:58:53+00:00

We currently assume that submissions from the sqthread are successful,
and if IO polling is enabled, we use that value for knowing how many
completions to look for. But if we overflowed the CQ ring or some
requests simply got errored and already completed, they won't be
available for polling.

For the case of IO polling and SQTHREAD usage, look at the pending
poll list. If it ever hits empty then we know that we don't have
anymore pollable requests inflight. For that case, simply reset
the inflight count to zero.

Reported-by: Pavel Begunkov 
Reviewed-by: Pavel Begunkov 
Signed-off-by: Jens Axboe

io_uring: used cached copies of sq->dropped and cq->overflow

2019-10-25T16:58:45+00:00

We currently use the ring values directly, but that can lead to issues
if the application is malicious and changes these values on our behalf.
Created in-kernel cached versions of them, and just overwrite the user
side when we update them. This is similar to how we treat the sq/cq
ring tail/head updates.

Reported-by: Pavel Begunkov 
Reviewed-by: Pavel Begunkov 
Signed-off-by: Jens Axboe

io_uring: Fix race for sqes with userspace

2019-10-25T15:02:01+00:00

io_ring_submit() finalises with
1. io_commit_sqring(), which releases sqes to the userspace
2. Then calls to io_queue_link_head(), accessing released head's sqe

Reorder them.

Signed-off-by: Pavel Begunkov 
Signed-off-by: Jens Axboe

io_uring: Fix broken links with offloading

2019-10-25T15:01:59+00:00

io_sq_thread() processes sqes by 8 without considering links. As a
result, links will be randomely subdivided.

The easiest way to fix it is to call io_get_sqring() inside
io_submit_sqes() as do io_ring_submit().

Downsides:
1. This removes optimisation of not grabbing mm_struct for fixed files
2. It submitting all sqes in one go, without finer-grained sheduling
with cq processing.

Signed-off-by: Pavel Begunkov 
Signed-off-by: Jens Axboe