1. 07 Apr, 2022 3 commits
    • Jens Axboe's avatar
      io_uring: drop the old style inflight file tracking · d5361233
      Jens Axboe authored
      io_uring tracks requests that are referencing an io_uring descriptor to
      be able to cancel without worrying about loops in the references. Since
      we now assign the file at execution time, the easier approach is to drop
      a potentially problematic reference before we punt the request. This
      eliminates the need to special case these types of files beyond just
      marking them as such, and simplifies cancelation quite a bit.
      
      This also fixes a recent issue where an async punted tee operation would
      with the io_uring descriptor as the output file would crash when
      attempting to get a reference to the file from the io-wq worker. We
      could have worked around that, but this is the much cleaner fix.
      
      Fixes: 6bf9c47a ("io_uring: defer file assignment")
      Reported-by: syzbot+c4b9303500a21750b250@syzkaller.appspotmail.com
      Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      d5361233
    • Jens Axboe's avatar
      io_uring: defer file assignment · 6bf9c47a
      Jens Axboe authored
      If an application uses direct open or accept, it knows in advance what
      direct descriptor value it will get as it picks it itself. This allows
      combined requests such as:
      
      sqe = io_uring_get_sqe(ring);
      io_uring_prep_openat_direct(sqe, ..., file_slot);
      sqe->flags |= IOSQE_IO_LINK | IOSQE_CQE_SKIP_SUCCESS;
      
      sqe = io_uring_get_sqe(ring);
      io_uring_prep_read(sqe,file_slot, buf, buf_size, 0);
      sqe->flags |= IOSQE_FIXED_FILE;
      
      io_uring_submit(ring);
      
      where we prepare both a file open and read, and only get a completion
      event for the read when both have completed successfully.
      
      Currently links are fully prepared before the head is issued, but that
      fails if the dependent link needs a file assigned that isn't valid until
      the head has completed.
      
      Conversely, if the same chain is performed but the fixed file slot is
      already valid, then we would be unexpectedly returning data from the
      old file slot rather than the newly opened one. Make sure we're
      consistent here.
      
      Allow deferral of file setup, which makes this documented case work.
      
      Cc: stable@vger.kernel.org # v5.15+
      Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      6bf9c47a
    • Jens Axboe's avatar
      io_uring: propagate issue_flags state down to file assignment · 5106dd6e
      Jens Axboe authored
      We'll need this in a future patch, when we could be assigning the file
      after the prep stage. While at it, get rid of the io_file_get() helper,
      it just makes the code harder to read.
      Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      5106dd6e
  2. 04 Apr, 2022 2 commits
  3. 03 Apr, 2022 9 commits
  4. 02 Apr, 2022 26 commits