sugar/linux
1
0
Fork 0
Code Activity

Merge tag 'io_uring-6.17-20250828' of git://git.kernel.dk/linux

Browse Source 
Pull io_uring fixes from Jens Axboe:

 - Use the proper type for min_t() in getting the min of the leftover
   bytes and the buffer length.

 - As good practice, use READ_ONCE() consistently for reading ring
   provided buffer lengths. Additionally, stop looping for incremental
   commits if a zero sized buffer is hit, as no further progress can be
   made at that point.

* tag 'io_uring-6.17-20250828' of git://git.kernel.dk/linux:
  io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths
  io_uring/kbuf: fix signedness in this_len calculation
This commit is contained in:
Linus Torvalds
2025-08-28 18:41:53 -07:00
parent 9c736ace06 98b6fa62c8
commit 220374ab2b
1 changed files with 13 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
io_uring/kbuf.c
View File

@@ -36,15 +36,19 @@ static bool io_kbuf_inc_commit(struct io_buffer_list *bl, int len)
{
while (len) {
struct io_uring_buf *buf;
u32 this_len;
u32 buf_len, this_len;
buf = io_ring_head_to_buf(bl->buf_ring, bl->head, bl->mask);
this_len = min_t(int, len, buf->len);
buf->len -= this_len;
if (buf->len) {
buf_len = READ_ONCE(buf->len);
this_len = min_t(u32, len, buf_len);
buf_len -= this_len;
/* Stop looping for invalid buffer length of 0 */
if (buf_len || !this_len) {
buf->addr += this_len;
buf->len = buf_len;
return false;
}
buf->len = 0;
bl->head++;
len -= this_len;
}
@@ -159,6 +163,7 @@ static void __user *io_ring_buffer_select(struct io_kiocb *req, size_t *len,
__u16 tail, head = bl->head;
struct io_uring_buf *buf;
void __user *ret;
u32 buf_len;
tail = smp_load_acquire(&br->tail);
if (unlikely(tail == head))
@@ -168,8 +173,9 @@ static void __user *io_ring_buffer_select(struct io_kiocb *req, size_t *len,
req->flags |= REQ_F_BL_EMPTY;
buf = io_ring_head_to_buf(br, head, bl->mask);
if (*len == 0 || *len > buf->len)
*len = buf->len;
buf_len = READ_ONCE(buf->len);
if (*len == 0 || *len > buf_len)
*len = buf_len;
req->flags |= REQ_F_BUFFER_RING | REQ_F_BUFFERS_COMMIT;
req->buf_list = bl;
req->buf_index = buf->bid;
@@ -265,7 +271,7 @@ static int io_ring_buffers_peek(struct io_kiocb *req, struct buf_sel_arg *arg,
req->buf_index = buf->bid;
do {
u32 len = buf->len;
u32 len = READ_ONCE(buf->len);
/* truncate end piece, if needed, for non partial buffers */
if (len > arg->max_len) {