| Message ID | c514446a8dcb0197cddd5d4ba8f6511da081cf1f.1743777957.git.asml.silence@gmail.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | [1/1] io_uring: fix rsrc tagging on registration failure | expand |
On 4/4/25 8:46 AM, Pavel Begunkov wrote: > Buffer / file table registration is all or nothing, if fails all > resources we might have partially registered are dropped and the table > is killed. When that happens it doesn't suppose to post any rsrc tag > CQEs, that would be a surprise to the user and it can't be handled. Needs a bit of editing, but I can do that. > Cc: stable@vger.kernel.org We should either put a backport target on this, or a Fixes tag. I guess a 6.1+ would suffice?
On 4/4/25 15:55, Jens Axboe wrote: > On 4/4/25 8:46 AM, Pavel Begunkov wrote: >> Buffer / file table registration is all or nothing, if fails all >> resources we might have partially registered are dropped and the table >> is killed. When that happens it doesn't suppose to post any rsrc tag >> CQEs, that would be a surprise to the user and it can't be handled. > > Needs a bit of editing, but I can do that. > >> Cc: stable@vger.kernel.org > > We should either put a backport target on this, or a Fixes tag. > I guess a 6.1+ would suffice? Fixes: 7029acd8a9503 ("io_uring/rsrc: get rid of per-ring io_rsrc_node list") Looks like this one. Recent enough, I thought I'd be worse.
On 4/4/25 9:37 AM, Pavel Begunkov wrote: > On 4/4/25 15:55, Jens Axboe wrote: >> On 4/4/25 8:46 AM, Pavel Begunkov wrote: >>> Buffer / file table registration is all or nothing, if fails all >>> resources we might have partially registered are dropped and the table >>> is killed. When that happens it doesn't suppose to post any rsrc tag >>> CQEs, that would be a surprise to the user and it can't be handled. >> >> Needs a bit of editing, but I can do that. >> >>> Cc: stable@vger.kernel.org >> >> We should either put a backport target on this, or a Fixes tag. >> I guess a 6.1+ would suffice? > > Fixes: 7029acd8a9503 ("io_uring/rsrc: get rid of per-ring io_rsrc_node list") > > Looks like this one. Recent enough, I thought I'd be worse. Oh yeah, that's nice and simple then.
On Fri, 04 Apr 2025 15:46:34 +0100, Pavel Begunkov wrote: > Buffer / file table registration is all or nothing, if fails all > resources we might have partially registered are dropped and the table > is killed. When that happens it doesn't suppose to post any rsrc tag > CQEs, that would be a surprise to the user and it can't be handled. > > Applied, thanks! [1/1] io_uring: fix rsrc tagging on registration failure commit: ab6005f3912fff07330297aba08922d2456dcede Best regards,
diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c index 5e64a8bb30a4..b36c8825550e 100644 --- a/io_uring/rsrc.c +++ b/io_uring/rsrc.c @@ -175,6 +175,18 @@ void io_rsrc_cache_free(struct io_ring_ctx *ctx) io_alloc_cache_free(&ctx->imu_cache, kfree); } +static void io_clear_table_tags(struct io_rsrc_data *data) +{ + int i; + + for (i = 0; i < data->nr; i++) { + struct io_rsrc_node *node = data->nodes[i]; + + if (node) + node->tag = 0; + } +} + __cold void io_rsrc_data_free(struct io_ring_ctx *ctx, struct io_rsrc_data *data) { @@ -583,6 +595,7 @@ int io_sqe_files_register(struct io_ring_ctx *ctx, void __user *arg, io_file_table_set_alloc_range(ctx, 0, ctx->file_table.data.nr); return 0; fail: + io_clear_table_tags(&ctx->file_table.data); io_sqe_files_unregister(ctx); return ret; } @@ -902,8 +915,10 @@ int io_sqe_buffers_register(struct io_ring_ctx *ctx, void __user *arg, } ctx->buf_table = data; - if (ret) + if (ret) { + io_clear_table_tags(&ctx->buf_table); io_sqe_buffers_unregister(ctx); + } return ret; }
Buffer / file table registration is all or nothing, if fails all resources we might have partially registered are dropped and the table is killed. When that happens it doesn't suppose to post any rsrc tag CQEs, that would be a surprise to the user and it can't be handled. Cc: stable@vger.kernel.org Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> --- io_uring/rsrc.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-)