Skip to content

Commit 1da8cf9

Browse files
torvaldstorvalds
committed
Merge tag 'io_uring-6.0-2022-08-13' of git://git.kernel.dk/linux-block
Pull io_uring fixes from Jens Axboe: - Regression fix for this merge window, fixing a wrong order of arguments for io_req_set_res() for passthru (Dylan) - Fix for the audit code leaking context memory (Peilin) - Ensure that provided buffers are memcg accounted (Pavel) - Correctly handle short zero-copy sends (Pavel) - Sparse warning fixes for the recvmsg multishot command (Dylan) - Error handling fix for passthru (Anuj) - Remove randomization of struct kiocb fields, to avoid it growing in size if re-arranged in such a fashion that it grows more holes or padding (Keith, Linus) - Small series improving type safety of the sqe fields (Stefan) * tag 'io_uring-6.0-2022-08-13' of git://git.kernel.dk/linux-block: io_uring: add missing BUILD_BUG_ON() checks for new io_uring_sqe fields io_uring: make io_kiocb_to_cmd() typesafe fs: don't randomize struct kiocb fields io_uring: consistently make use of io_notif_to_data() io_uring: fix error handling for io_uring_cmd io_uring: fix io_recvmsg_prep_multishot sparse warnings io_uring/net: send retry for zerocopy io_uring: mem-account pbuf buckets audit, io_uring, io-wq: Fix memory leak in io_sq_thread() and io_wqe_worker() io_uring: pass correct parameters to io_req_set_res
2 parents 69dac8e + 9c71d39 commit 1da8cf9

26 files changed

+178
-183
lines changed

‎include/linux/audit.h

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -285,7 +285,6 @@ static inline int audit_signal_info(int sig, struct task_struct *t)
285285
/* These are defined in auditsc.c */
286286
/* Public API */
287287
extern int audit_alloc(struct task_struct *task);
288-
extern int audit_alloc_kernel(struct task_struct *task);
289288
extern void __audit_free(struct task_struct *task);
290289
extern void __audit_uring_entry(u8 op);
291290
extern void __audit_uring_exit(int success, long code);
@@ -578,10 +577,6 @@ static inline int audit_alloc(struct task_struct *task)
578577
{
579578
return 0;
580579
}
581-
static inline int audit_alloc_kernel(struct task_struct *task)
582-
{
583-
return 0;
584-
}
585580
static inline void audit_free(struct task_struct *task)
586581
{ }
587582
static inline void audit_uring_entry(u8 op)

‎include/linux/fs.h

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -340,17 +340,12 @@ enum rw_hint {
340340

341341
struct kiocb {
342342
struct file *ki_filp;
343-
344-
/* The 'ki_filp' pointer is shared in a union for aio */
345-
randomized_struct_fields_start
346-
347343
loff_t ki_pos;
348344
void (*ki_complete)(struct kiocb *iocb, long ret);
349345
void *private;
350346
int ki_flags;
351347
u16 ki_ioprio; /* See linux/ioprio.h */
352348
struct wait_page_queue *ki_waitq; /* for async buffered IO */
353-
randomized_struct_fields_end
354349
};
355350

356351
static inline bool is_sync_kiocb(struct kiocb *kiocb)

‎include/linux/io_uring_types.h

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -491,7 +491,14 @@ struct io_cmd_data {
491491
__u8 data[56];
492492
};
493493

494-
#define io_kiocb_to_cmd(req) ((void *) &(req)->cmd)
494+
static inline void io_kiocb_cmd_sz_check(size_t cmd_sz)
495+
{
496+
BUILD_BUG_ON(cmd_sz > sizeof(struct io_cmd_data));
497+
}
498+
#define io_kiocb_to_cmd(req, cmd_type) ( \
499+
io_kiocb_cmd_sz_check(sizeof(cmd_type)) , \
500+
((cmd_type *)&(req)->cmd) \
501+
)
495502
#define cmd_to_io_kiocb(ptr) ((struct io_kiocb *) ptr)
496503

497504
struct io_kiocb {

‎io_uring/advise.c

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ struct io_madvise {
3131
int io_madvise_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
3232
{
3333
#if defined(CONFIG_ADVISE_SYSCALLS) && defined(CONFIG_MMU)
34-
struct io_madvise *ma = io_kiocb_to_cmd(req);
34+
struct io_madvise *ma = io_kiocb_to_cmd(req, struct io_madvise);
3535

3636
if (sqe->buf_index || sqe->off || sqe->splice_fd_in)
3737
return -EINVAL;
@@ -48,7 +48,7 @@ int io_madvise_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
4848
int io_madvise(struct io_kiocb *req, unsigned int issue_flags)
4949
{
5050
#if defined(CONFIG_ADVISE_SYSCALLS) && defined(CONFIG_MMU)
51-
struct io_madvise *ma = io_kiocb_to_cmd(req);
51+
struct io_madvise *ma = io_kiocb_to_cmd(req, struct io_madvise);
5252
int ret;
5353

5454
if (issue_flags & IO_URING_F_NONBLOCK)
@@ -64,7 +64,7 @@ int io_madvise(struct io_kiocb *req, unsigned int issue_flags)
6464

6565
int io_fadvise_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
6666
{
67-
struct io_fadvise *fa = io_kiocb_to_cmd(req);
67+
struct io_fadvise *fa = io_kiocb_to_cmd(req, struct io_fadvise);
6868

6969
if (sqe->buf_index || sqe->addr || sqe->splice_fd_in)
7070
return -EINVAL;
@@ -77,7 +77,7 @@ int io_fadvise_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
7777

7878
int io_fadvise(struct io_kiocb *req, unsigned int issue_flags)
7979
{
80-
struct io_fadvise *fa = io_kiocb_to_cmd(req);
80+
struct io_fadvise *fa = io_kiocb_to_cmd(req, struct io_fadvise);
8181
int ret;
8282

8383
if (issue_flags & IO_URING_F_NONBLOCK) {

‎io_uring/cancel.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -107,7 +107,7 @@ int io_try_cancel(struct io_uring_task *tctx, struct io_cancel_data *cd,
107107

108108
int io_async_cancel_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
109109
{
110-
struct io_cancel *cancel = io_kiocb_to_cmd(req);
110+
struct io_cancel *cancel = io_kiocb_to_cmd(req, struct io_cancel);
111111

112112
if (unlikely(req->flags & REQ_F_BUFFER_SELECT))
113113
return -EINVAL;
@@ -164,7 +164,7 @@ static int __io_async_cancel(struct io_cancel_data *cd,
164164

165165
int io_async_cancel(struct io_kiocb *req, unsigned int issue_flags)
166166
{
167-
struct io_cancel *cancel = io_kiocb_to_cmd(req);
167+
struct io_cancel *cancel = io_kiocb_to_cmd(req, struct io_cancel);
168168
struct io_cancel_data cd = {
169169
.ctx = req->ctx,
170170
.data = cancel->addr,

‎io_uring/epoll.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ struct io_epoll {
2323

2424
int io_epoll_ctl_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
2525
{
26-
struct io_epoll *epoll = io_kiocb_to_cmd(req);
26+
struct io_epoll *epoll = io_kiocb_to_cmd(req, struct io_epoll);
2727

2828
pr_warn_once("%s: epoll_ctl support in io_uring is deprecated and will "
2929
"be removed in a future Linux kernel version.\n",
@@ -49,7 +49,7 @@ int io_epoll_ctl_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
4949

5050
int io_epoll_ctl(struct io_kiocb *req, unsigned int issue_flags)
5151
{
52-
struct io_epoll *ie = io_kiocb_to_cmd(req);
52+
struct io_epoll *ie = io_kiocb_to_cmd(req, struct io_epoll);
5353
int ret;
5454
bool force_nonblock = issue_flags & IO_URING_F_NONBLOCK;
5555

‎io_uring/fs.c

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ struct io_link {
4949

5050
int io_renameat_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
5151
{
52-
struct io_rename *ren = io_kiocb_to_cmd(req);
52+
struct io_rename *ren = io_kiocb_to_cmd(req, struct io_rename);
5353
const char __user *oldf, *newf;
5454

5555
if (sqe->buf_index || sqe->splice_fd_in)
@@ -79,7 +79,7 @@ int io_renameat_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
7979

8080
int io_renameat(struct io_kiocb *req, unsigned int issue_flags)
8181
{
82-
struct io_rename *ren = io_kiocb_to_cmd(req);
82+
struct io_rename *ren = io_kiocb_to_cmd(req, struct io_rename);
8383
int ret;
8484

8585
if (issue_flags & IO_URING_F_NONBLOCK)
@@ -95,15 +95,15 @@ int io_renameat(struct io_kiocb *req, unsigned int issue_flags)
9595

9696
void io_renameat_cleanup(struct io_kiocb *req)
9797
{
98-
struct io_rename *ren = io_kiocb_to_cmd(req);
98+
struct io_rename *ren = io_kiocb_to_cmd(req, struct io_rename);
9999

100100
putname(ren->oldpath);
101101
putname(ren->newpath);
102102
}
103103

104104
int io_unlinkat_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
105105
{
106-
struct io_unlink *un = io_kiocb_to_cmd(req);
106+
struct io_unlink *un = io_kiocb_to_cmd(req, struct io_unlink);
107107
const char __user *fname;
108108

109109
if (sqe->off || sqe->len || sqe->buf_index || sqe->splice_fd_in)
@@ -128,7 +128,7 @@ int io_unlinkat_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
128128

129129
int io_unlinkat(struct io_kiocb *req, unsigned int issue_flags)
130130
{
131-
struct io_unlink *un = io_kiocb_to_cmd(req);
131+
struct io_unlink *un = io_kiocb_to_cmd(req, struct io_unlink);
132132
int ret;
133133

134134
if (issue_flags & IO_URING_F_NONBLOCK)
@@ -146,14 +146,14 @@ int io_unlinkat(struct io_kiocb *req, unsigned int issue_flags)
146146

147147
void io_unlinkat_cleanup(struct io_kiocb *req)
148148
{
149-
struct io_unlink *ul = io_kiocb_to_cmd(req);
149+
struct io_unlink *ul = io_kiocb_to_cmd(req, struct io_unlink);
150150

151151
putname(ul->filename);
152152
}
153153

154154
int io_mkdirat_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
155155
{
156-
struct io_mkdir *mkd = io_kiocb_to_cmd(req);
156+
struct io_mkdir *mkd = io_kiocb_to_cmd(req, struct io_mkdir);
157157
const char __user *fname;
158158

159159
if (sqe->off || sqe->rw_flags || sqe->buf_index || sqe->splice_fd_in)
@@ -175,7 +175,7 @@ int io_mkdirat_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
175175

176176
int io_mkdirat(struct io_kiocb *req, unsigned int issue_flags)
177177
{
178-
struct io_mkdir *mkd = io_kiocb_to_cmd(req);
178+
struct io_mkdir *mkd = io_kiocb_to_cmd(req, struct io_mkdir);
179179
int ret;
180180

181181
if (issue_flags & IO_URING_F_NONBLOCK)
@@ -190,14 +190,14 @@ int io_mkdirat(struct io_kiocb *req, unsigned int issue_flags)
190190

191191
void io_mkdirat_cleanup(struct io_kiocb *req)
192192
{
193-
struct io_mkdir *md = io_kiocb_to_cmd(req);
193+
struct io_mkdir *md = io_kiocb_to_cmd(req, struct io_mkdir);
194194

195195
putname(md->filename);
196196
}
197197

198198
int io_symlinkat_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
199199
{
200-
struct io_link *sl = io_kiocb_to_cmd(req);
200+
struct io_link *sl = io_kiocb_to_cmd(req, struct io_link);
201201
const char __user *oldpath, *newpath;
202202

203203
if (sqe->len || sqe->rw_flags || sqe->buf_index || sqe->splice_fd_in)
@@ -225,7 +225,7 @@ int io_symlinkat_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
225225

226226
int io_symlinkat(struct io_kiocb *req, unsigned int issue_flags)
227227
{
228-
struct io_link *sl = io_kiocb_to_cmd(req);
228+
struct io_link *sl = io_kiocb_to_cmd(req, struct io_link);
229229
int ret;
230230

231231
if (issue_flags & IO_URING_F_NONBLOCK)
@@ -240,7 +240,7 @@ int io_symlinkat(struct io_kiocb *req, unsigned int issue_flags)
240240

241241
int io_linkat_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
242242
{
243-
struct io_link *lnk = io_kiocb_to_cmd(req);
243+
struct io_link *lnk = io_kiocb_to_cmd(req, struct io_link);
244244
const char __user *oldf, *newf;
245245

246246
if (sqe->rw_flags || sqe->buf_index || sqe->splice_fd_in)
@@ -270,7 +270,7 @@ int io_linkat_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
270270

271271
int io_linkat(struct io_kiocb *req, unsigned int issue_flags)
272272
{
273-
struct io_link *lnk = io_kiocb_to_cmd(req);
273+
struct io_link *lnk = io_kiocb_to_cmd(req, struct io_link);
274274
int ret;
275275

276276
if (issue_flags & IO_URING_F_NONBLOCK)
@@ -286,7 +286,7 @@ int io_linkat(struct io_kiocb *req, unsigned int issue_flags)
286286

287287
void io_link_cleanup(struct io_kiocb *req)
288288
{
289-
struct io_link *sl = io_kiocb_to_cmd(req);
289+
struct io_link *sl = io_kiocb_to_cmd(req, struct io_link);
290290

291291
putname(sl->oldpath);
292292
putname(sl->newpath);

‎io_uring/io-wq.c

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -624,8 +624,6 @@ static int io_wqe_worker(void *data)
624624
snprintf(buf, sizeof(buf), "iou-wrk-%d", wq->task->pid);
625625
set_task_comm(current, buf);
626626

627-
audit_alloc_kernel(current);
628-
629627
while (!test_bit(IO_WQ_BIT_EXIT, &wq->state)) {
630628
long ret;
631629

@@ -660,7 +658,6 @@ static int io_wqe_worker(void *data)
660658
if (test_bit(IO_WQ_BIT_EXIT, &wq->state))
661659
io_worker_handle_work(worker);
662660

663-
audit_free(current);
664661
io_worker_exit(worker);
665662
return 0;
666663
}

‎io_uring/io_uring.c

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3885,20 +3885,24 @@ SYSCALL_DEFINE4(io_uring_register, unsigned int, fd, unsigned int, opcode,
38853885

38863886
static int __init io_uring_init(void)
38873887
{
3888-
#define __BUILD_BUG_VERIFY_ELEMENT(stype, eoffset, etype, ename) do { \
3888+
#define __BUILD_BUG_VERIFY_OFFSET_SIZE(stype, eoffset, esize, ename) do { \
38893889
BUILD_BUG_ON(offsetof(stype, ename) != eoffset); \
3890-
BUILD_BUG_ON(sizeof(etype) != sizeof_field(stype, ename)); \
3890+
BUILD_BUG_ON(sizeof_field(stype, ename) != esize); \
38913891
} while (0)
38923892

38933893
#define BUILD_BUG_SQE_ELEM(eoffset, etype, ename) \
3894-
__BUILD_BUG_VERIFY_ELEMENT(struct io_uring_sqe, eoffset, etype, ename)
3894+
__BUILD_BUG_VERIFY_OFFSET_SIZE(struct io_uring_sqe, eoffset, sizeof(etype), ename)
3895+
#define BUILD_BUG_SQE_ELEM_SIZE(eoffset, esize, ename) \
3896+
__BUILD_BUG_VERIFY_OFFSET_SIZE(struct io_uring_sqe, eoffset, esize, ename)
38953897
BUILD_BUG_ON(sizeof(struct io_uring_sqe) != 64);
38963898
BUILD_BUG_SQE_ELEM(0, __u8, opcode);
38973899
BUILD_BUG_SQE_ELEM(1, __u8, flags);
38983900
BUILD_BUG_SQE_ELEM(2, __u16, ioprio);
38993901
BUILD_BUG_SQE_ELEM(4, __s32, fd);
39003902
BUILD_BUG_SQE_ELEM(8, __u64, off);
39013903
BUILD_BUG_SQE_ELEM(8, __u64, addr2);
3904+
BUILD_BUG_SQE_ELEM(8, __u32, cmd_op);
3905+
BUILD_BUG_SQE_ELEM(12, __u32, __pad1);
39023906
BUILD_BUG_SQE_ELEM(16, __u64, addr);
39033907
BUILD_BUG_SQE_ELEM(16, __u64, splice_off_in);
39043908
BUILD_BUG_SQE_ELEM(24, __u32, len);
@@ -3917,13 +3921,22 @@ static int __init io_uring_init(void)
39173921
BUILD_BUG_SQE_ELEM(28, __u32, statx_flags);
39183922
BUILD_BUG_SQE_ELEM(28, __u32, fadvise_advice);
39193923
BUILD_BUG_SQE_ELEM(28, __u32, splice_flags);
3924+
BUILD_BUG_SQE_ELEM(28, __u32, rename_flags);
3925+
BUILD_BUG_SQE_ELEM(28, __u32, unlink_flags);
3926+
BUILD_BUG_SQE_ELEM(28, __u32, hardlink_flags);
3927+
BUILD_BUG_SQE_ELEM(28, __u32, xattr_flags);
3928+
BUILD_BUG_SQE_ELEM(28, __u32, msg_ring_flags);
39203929
BUILD_BUG_SQE_ELEM(32, __u64, user_data);
39213930
BUILD_BUG_SQE_ELEM(40, __u16, buf_index);
39223931
BUILD_BUG_SQE_ELEM(40, __u16, buf_group);
39233932
BUILD_BUG_SQE_ELEM(42, __u16, personality);
39243933
BUILD_BUG_SQE_ELEM(44, __s32, splice_fd_in);
39253934
BUILD_BUG_SQE_ELEM(44, __u32, file_index);
3935+
BUILD_BUG_SQE_ELEM(44, __u16, notification_idx);
3936+
BUILD_BUG_SQE_ELEM(46, __u16, addr_len);
39263937
BUILD_BUG_SQE_ELEM(48, __u64, addr3);
3938+
BUILD_BUG_SQE_ELEM_SIZE(48, 0, cmd);
3939+
BUILD_BUG_SQE_ELEM(56, __u64, __pad2);
39273940

39283941
BUILD_BUG_ON(sizeof(struct io_uring_files_update) !=
39293942
sizeof(struct io_uring_rsrc_update));

‎io_uring/kbuf.c

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -272,7 +272,7 @@ void io_destroy_buffers(struct io_ring_ctx *ctx)
272272

273273
int io_remove_buffers_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
274274
{
275-
struct io_provide_buf *p = io_kiocb_to_cmd(req);
275+
struct io_provide_buf *p = io_kiocb_to_cmd(req, struct io_provide_buf);
276276
u64 tmp;
277277

278278
if (sqe->rw_flags || sqe->addr || sqe->len || sqe->off ||
@@ -291,7 +291,7 @@ int io_remove_buffers_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
291291

292292
int io_remove_buffers(struct io_kiocb *req, unsigned int issue_flags)
293293
{
294-
struct io_provide_buf *p = io_kiocb_to_cmd(req);
294+
struct io_provide_buf *p = io_kiocb_to_cmd(req, struct io_provide_buf);
295295
struct io_ring_ctx *ctx = req->ctx;
296296
struct io_buffer_list *bl;
297297
int ret = 0;
@@ -319,7 +319,7 @@ int io_remove_buffers(struct io_kiocb *req, unsigned int issue_flags)
319319
int io_provide_buffers_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
320320
{
321321
unsigned long size, tmp_check;
322-
struct io_provide_buf *p = io_kiocb_to_cmd(req);
322+
struct io_provide_buf *p = io_kiocb_to_cmd(req, struct io_provide_buf);
323323
u64 tmp;
324324

325325
if (sqe->rw_flags || sqe->splice_fd_in)
@@ -421,7 +421,7 @@ static int io_add_buffers(struct io_ring_ctx *ctx, struct io_provide_buf *pbuf,
421421

422422
int io_provide_buffers(struct io_kiocb *req, unsigned int issue_flags)
423423
{
424-
struct io_provide_buf *p = io_kiocb_to_cmd(req);
424+
struct io_provide_buf *p = io_kiocb_to_cmd(req, struct io_provide_buf);
425425
struct io_ring_ctx *ctx = req->ctx;
426426
struct io_buffer_list *bl;
427427
int ret = 0;
@@ -436,7 +436,7 @@ int io_provide_buffers(struct io_kiocb *req, unsigned int issue_flags)
436436

437437
bl = io_buffer_get_list(ctx, p->bgid);
438438
if (unlikely(!bl)) {
439-
bl = kzalloc(sizeof(*bl), GFP_KERNEL);
439+
bl = kzalloc(sizeof(*bl), GFP_KERNEL_ACCOUNT);
440440
if (!bl) {
441441
ret = -ENOMEM;
442442
goto err;

0 commit comments

Comments
 (0)