[thirdparty/linux.git] / io_uring / cancel.c

// SPDX-License-Identifier: GPL-2.0
#include <linux/kernel.h>
#include <linux/errno.h>
#include <linux/fs.h>
#include <linux/file.h>
#include <linux/mm.h>
#include <linux/slab.h>
#include <linux/namei.h>
#include <linux/nospec.h>
#include <linux/io_uring.h>

#include <uapi/linux/io_uring.h>

#include "io_uring.h"
#include "tctx.h"
#include "poll.h"
#include "timeout.h"
#include "cancel.h"

struct io_cancel {
	struct file			*file;
	u64				addr;
	u32				flags;
	s32				fd;
};

#define CANCEL_FLAGS	(IORING_ASYNC_CANCEL_ALL | IORING_ASYNC_CANCEL_FD | \
			 IORING_ASYNC_CANCEL_ANY | IORING_ASYNC_CANCEL_FD_FIXED)

static bool io_cancel_cb(struct io_wq_work *work, void *data)
{
	struct io_kiocb *req = container_of(work, struct io_kiocb, work);
	struct io_cancel_data *cd = data;

	if (req->ctx != cd->ctx)
		return false;
	if (cd->flags & IORING_ASYNC_CANCEL_ANY) {
		;
	} else if (cd->flags & IORING_ASYNC_CANCEL_FD) {
		if (req->file != cd->file)
			return false;
	} else {
		if (req->cqe.user_data != cd->data)
			return false;
	}
	if (cd->flags & (IORING_ASYNC_CANCEL_ALL|IORING_ASYNC_CANCEL_ANY)) {
		if (cd->seq == req->work.cancel_seq)
			return false;
		req->work.cancel_seq = cd->seq;
	}
	return true;
}

static int io_async_cancel_one(struct io_uring_task *tctx,
			       struct io_cancel_data *cd)
{
	enum io_wq_cancel cancel_ret;
	int ret = 0;
	bool all;

	if (!tctx || !tctx->io_wq)
		return -ENOENT;

	all = cd->flags & (IORING_ASYNC_CANCEL_ALL|IORING_ASYNC_CANCEL_ANY);
	cancel_ret = io_wq_cancel_cb(tctx->io_wq, io_cancel_cb, cd, all);
	switch (cancel_ret) {
	case IO_WQ_CANCEL_OK:
		ret = 0;
		break;
	case IO_WQ_CANCEL_RUNNING:
		ret = -EALREADY;
		break;
	case IO_WQ_CANCEL_NOTFOUND:
		ret = -ENOENT;
		break;
	}

	return ret;
}

int io_try_cancel(struct io_uring_task *tctx, struct io_cancel_data *cd,
		  unsigned issue_flags)
{
	struct io_ring_ctx *ctx = cd->ctx;
	int ret;

	WARN_ON_ONCE(!io_wq_current_is_worker() && tctx != current->io_uring);

	ret = io_async_cancel_one(tctx, cd);
	/*
	 * Fall-through even for -EALREADY, as we may have poll armed
	 * that need unarming.
	 */
	if (!ret)
		return 0;

	ret = io_poll_cancel(ctx, cd, issue_flags);
	if (ret != -ENOENT)
		return ret;

	spin_lock(&ctx->completion_lock);
	if (!(cd->flags & IORING_ASYNC_CANCEL_FD))
		ret = io_timeout_cancel(ctx, cd);
	spin_unlock(&ctx->completion_lock);
	return ret;
}

int io_async_cancel_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
{
	struct io_cancel *cancel = io_kiocb_to_cmd(req, struct io_cancel);

	if (unlikely(req->flags & REQ_F_BUFFER_SELECT))
		return -EINVAL;
	if (sqe->off || sqe->len || sqe->splice_fd_in)
		return -EINVAL;

	cancel->addr = READ_ONCE(sqe->addr);
	cancel->flags = READ_ONCE(sqe->cancel_flags);
	if (cancel->flags & ~CANCEL_FLAGS)
		return -EINVAL;
	if (cancel->flags & IORING_ASYNC_CANCEL_FD) {
		if (cancel->flags & IORING_ASYNC_CANCEL_ANY)
			return -EINVAL;
		cancel->fd = READ_ONCE(sqe->fd);
	}

	return 0;
}

static int __io_async_cancel(struct io_cancel_data *cd,
			     struct io_uring_task *tctx,
			     unsigned int issue_flags)
{
	bool all = cd->flags & (IORING_ASYNC_CANCEL_ALL|IORING_ASYNC_CANCEL_ANY);
	struct io_ring_ctx *ctx = cd->ctx;
	struct io_tctx_node *node;
	int ret, nr = 0;

	do {
		ret = io_try_cancel(tctx, cd, issue_flags);
		if (ret == -ENOENT)
			break;
		if (!all)
			return ret;
		nr++;
	} while (1);

	/* slow path, try all io-wq's */
	io_ring_submit_lock(ctx, issue_flags);
	ret = -ENOENT;
	list_for_each_entry(node, &ctx->tctx_list, ctx_node) {
		struct io_uring_task *tctx = node->task->io_uring;

		ret = io_async_cancel_one(tctx, cd);
		if (ret != -ENOENT) {
			if (!all)
				break;
			nr++;
		}
	}
	io_ring_submit_unlock(ctx, issue_flags);
	return all ? nr : ret;
}

int io_async_cancel(struct io_kiocb *req, unsigned int issue_flags)
{
	struct io_cancel *cancel = io_kiocb_to_cmd(req, struct io_cancel);
	struct io_cancel_data cd = {
		.ctx	= req->ctx,
		.data	= cancel->addr,
		.flags	= cancel->flags,
		.seq	= atomic_inc_return(&req->ctx->cancel_seq),
	};
	struct io_uring_task *tctx = req->task->io_uring;
	int ret;

	if (cd.flags & IORING_ASYNC_CANCEL_FD) {
		if (req->flags & REQ_F_FIXED_FILE ||
		    cd.flags & IORING_ASYNC_CANCEL_FD_FIXED) {
			req->flags |= REQ_F_FIXED_FILE;
			req->file = io_file_get_fixed(req, cancel->fd,
							issue_flags);
		} else {
			req->file = io_file_get_normal(req, cancel->fd);
		}
		if (!req->file) {
			ret = -EBADF;
			goto done;
		}
		cd.file = req->file;
	}

	ret = __io_async_cancel(&cd, tctx, issue_flags);
done:
	if (ret < 0)
		req_set_fail(req);
	io_req_set_res(req, ret, 0);
	return IOU_OK;
}

void init_hash_table(struct io_hash_table *table, unsigned size)
{
	unsigned int i;

	for (i = 0; i < size; i++) {
		spin_lock_init(&table->hbs[i].lock);
		INIT_HLIST_HEAD(&table->hbs[i].list);
	}
}

static int __io_sync_cancel(struct io_uring_task *tctx,
			    struct io_cancel_data *cd, int fd)
{
	struct io_ring_ctx *ctx = cd->ctx;

	/* fixed must be grabbed every time since we drop the uring_lock */
	if ((cd->flags & IORING_ASYNC_CANCEL_FD) &&
	    (cd->flags & IORING_ASYNC_CANCEL_FD_FIXED)) {
		if (unlikely(fd >= ctx->nr_user_files))
			return -EBADF;
		fd = array_index_nospec(fd, ctx->nr_user_files);
		cd->file = io_file_from_index(&ctx->file_table, fd);
		if (!cd->file)
			return -EBADF;
	}

	return __io_async_cancel(cd, tctx, 0);
}

int io_sync_cancel(struct io_ring_ctx *ctx, void __user *arg)
	__must_hold(&ctx->uring_lock)
{
	struct io_cancel_data cd = {
		.ctx	= ctx,
		.seq	= atomic_inc_return(&ctx->cancel_seq),
	};
	ktime_t timeout = KTIME_MAX;
	struct io_uring_sync_cancel_reg sc;
	struct fd f = { };
	DEFINE_WAIT(wait);
	int ret;

	if (copy_from_user(&sc, arg, sizeof(sc)))
		return -EFAULT;
	if (sc.flags & ~CANCEL_FLAGS)
		return -EINVAL;
	if (sc.pad[0] || sc.pad[1] || sc.pad[2] || sc.pad[3])
		return -EINVAL;

	cd.data = sc.addr;
	cd.flags = sc.flags;

	/* we can grab a normal file descriptor upfront */
	if ((cd.flags & IORING_ASYNC_CANCEL_FD) &&
	   !(cd.flags & IORING_ASYNC_CANCEL_FD_FIXED)) {
		f = fdget(sc.fd);
		if (!f.file)
			return -EBADF;
		cd.file = f.file;
	}

	ret = __io_sync_cancel(current->io_uring, &cd, sc.fd);

	/* found something, done! */
	if (ret != -EALREADY)
		goto out;

	if (sc.timeout.tv_sec != -1UL || sc.timeout.tv_nsec != -1UL) {
		struct timespec64 ts = {
			.tv_sec		= sc.timeout.tv_sec,
			.tv_nsec	= sc.timeout.tv_nsec
		};

		timeout = ktime_add_ns(timespec64_to_ktime(ts), ktime_get_ns());
	}

	/*
	 * Keep looking until we get -ENOENT. we'll get woken everytime
	 * every time a request completes and will retry the cancelation.
	 */
	do {
		cd.seq = atomic_inc_return(&ctx->cancel_seq);

		prepare_to_wait(&ctx->cq_wait, &wait, TASK_INTERRUPTIBLE);

		ret = __io_sync_cancel(current->io_uring, &cd, sc.fd);

		mutex_unlock(&ctx->uring_lock);
		if (ret != -EALREADY)
			break;

		ret = io_run_task_work_sig(ctx);
		if (ret < 0)
			break;
		ret = schedule_hrtimeout(&timeout, HRTIMER_MODE_ABS);
		if (!ret) {
			ret = -ETIME;
			break;
		}
		mutex_lock(&ctx->uring_lock);
	} while (1);

	finish_wait(&ctx->cq_wait, &wait);
	mutex_lock(&ctx->uring_lock);

	if (ret == -ENOENT || ret > 0)
		ret = 0;
out:
	fdput(f);
	return ret;
}
Commit	Line	Data
7aaff708 JA	1	// SPDX-License-Identifier: GPL-2.0
	2	#include <linux/kernel.h>
	3	#include <linux/errno.h>
	4	#include <linux/fs.h>
	5	#include <linux/file.h>
	6	#include <linux/mm.h>
	7	#include <linux/slab.h>
	8	#include <linux/namei.h>
78a861b9	9	#include <linux/nospec.h>
7aaff708 JA	10	#include <linux/io_uring.h>
	11
	12	#include <uapi/linux/io_uring.h>
	13
7aaff708 JA	14	#include "io_uring.h"
	15	#include "tctx.h"
	16	#include "poll.h"
	17	#include "timeout.h"
	18	#include "cancel.h"
	19
	20	struct io_cancel {
	21	struct file *file;
	22	u64 addr;
	23	u32 flags;
	24	s32 fd;
	25	};
	26
	27	#define CANCEL_FLAGS (IORING_ASYNC_CANCEL_ALL \| IORING_ASYNC_CANCEL_FD \| \
7d8ca725	28	IORING_ASYNC_CANCEL_ANY \| IORING_ASYNC_CANCEL_FD_FIXED)
7aaff708 JA	29
	30	static bool io_cancel_cb(struct io_wq_work work, void data)
	31	{
	32	struct io_kiocb *req = container_of(work, struct io_kiocb, work);
	33	struct io_cancel_data *cd = data;
	34
	35	if (req->ctx != cd->ctx)
	36	return false;
	37	if (cd->flags & IORING_ASYNC_CANCEL_ANY) {
	38	;
	39	} else if (cd->flags & IORING_ASYNC_CANCEL_FD) {
	40	if (req->file != cd->file)
	41	return false;
	42	} else {
	43	if (req->cqe.user_data != cd->data)
	44	return false;
	45	}
	46	if (cd->flags & (IORING_ASYNC_CANCEL_ALL\|IORING_ASYNC_CANCEL_ANY)) {
	47	if (cd->seq == req->work.cancel_seq)
	48	return false;
	49	req->work.cancel_seq = cd->seq;
	50	}
	51	return true;
	52	}
	53
	54	static int io_async_cancel_one(struct io_uring_task *tctx,
	55	struct io_cancel_data *cd)
	56	{
	57	enum io_wq_cancel cancel_ret;
	58	int ret = 0;
	59	bool all;
	60
	61	if (!tctx \|\| !tctx->io_wq)
	62	return -ENOENT;
	63
	64	all = cd->flags & (IORING_ASYNC_CANCEL_ALL\|IORING_ASYNC_CANCEL_ANY);
	65	cancel_ret = io_wq_cancel_cb(tctx->io_wq, io_cancel_cb, cd, all);
	66	switch (cancel_ret) {
	67	case IO_WQ_CANCEL_OK:
	68	ret = 0;
	69	break;
	70	case IO_WQ_CANCEL_RUNNING:
	71	ret = -EALREADY;
	72	break;
	73	case IO_WQ_CANCEL_NOTFOUND:
	74	ret = -ENOENT;
	75	break;
	76	}
	77
	78	return ret;
	79	}
	80
88f52eaa	81	int io_try_cancel(struct io_uring_task tctx, struct io_cancel_data cd,
5d7943d9	82	unsigned issue_flags)
7aaff708	83	{
88f52eaa	84	struct io_ring_ctx *ctx = cd->ctx;
7aaff708 JA	85	int ret;
7aaff708 JA	86
88f52eaa	87	WARN_ON_ONCE(!io_wq_current_is_worker() && tctx != current->io_uring);
7aaff708	88
88f52eaa	89	ret = io_async_cancel_one(tctx, cd);
7aaff708 JA	90	/*
	91	* Fall-through even for -EALREADY, as we may have poll armed
	92	* that need unarming.
	93	*/
	94	if (!ret)
	95	return 0;
	96
5d7943d9	97	ret = io_poll_cancel(ctx, cd, issue_flags);
7aaff708	98	if (ret != -ENOENT)
4dfab8ab PB	99	return ret;
4dfab8ab PB	100
38513c46	101	spin_lock(&ctx->completion_lock);
7aaff708 JA	102	if (!(cd->flags & IORING_ASYNC_CANCEL_FD))
7aaff708 JA	103	ret = io_timeout_cancel(ctx, cd);
7aaff708 JA	104	spin_unlock(&ctx->completion_lock);
	105	return ret;
	106	}
	107
7aaff708 JA	108	int io_async_cancel_prep(struct io_kiocb req, const struct io_uring_sqe sqe)
7aaff708 JA	109	{
f2ccb5ae	110	struct io_cancel *cancel = io_kiocb_to_cmd(req, struct io_cancel);
7aaff708 JA	111
	112	if (unlikely(req->flags & REQ_F_BUFFER_SELECT))
	113	return -EINVAL;
	114	if (sqe->off \|\| sqe->len \|\| sqe->splice_fd_in)
	115	return -EINVAL;
	116
	117	cancel->addr = READ_ONCE(sqe->addr);
	118	cancel->flags = READ_ONCE(sqe->cancel_flags);
	119	if (cancel->flags & ~CANCEL_FLAGS)
	120	return -EINVAL;
	121	if (cancel->flags & IORING_ASYNC_CANCEL_FD) {
	122	if (cancel->flags & IORING_ASYNC_CANCEL_ANY)
	123	return -EINVAL;
	124	cancel->fd = READ_ONCE(sqe->fd);
	125	}
	126
	127	return 0;
	128	}
	129
88f52eaa JA	130	static int __io_async_cancel(struct io_cancel_data *cd,
88f52eaa JA	131	struct io_uring_task *tctx,
7aaff708 JA	132	unsigned int issue_flags)
	133	{
	134	bool all = cd->flags & (IORING_ASYNC_CANCEL_ALL\|IORING_ASYNC_CANCEL_ANY);
	135	struct io_ring_ctx *ctx = cd->ctx;
	136	struct io_tctx_node *node;
	137	int ret, nr = 0;
	138
	139	do {
88f52eaa	140	ret = io_try_cancel(tctx, cd, issue_flags);
7aaff708 JA	141	if (ret == -ENOENT)
	142	break;
	143	if (!all)
	144	return ret;
	145	nr++;
	146	} while (1);
	147
	148	/* slow path, try all io-wq's */
	149	io_ring_submit_lock(ctx, issue_flags);
	150	ret = -ENOENT;
	151	list_for_each_entry(node, &ctx->tctx_list, ctx_node) {
	152	struct io_uring_task *tctx = node->task->io_uring;
	153
	154	ret = io_async_cancel_one(tctx, cd);
	155	if (ret != -ENOENT) {
	156	if (!all)
	157	break;
	158	nr++;
	159	}
	160	}
	161	io_ring_submit_unlock(ctx, issue_flags);
	162	return all ? nr : ret;
	163	}
	164
	165	int io_async_cancel(struct io_kiocb *req, unsigned int issue_flags)
	166	{
f2ccb5ae	167	struct io_cancel *cancel = io_kiocb_to_cmd(req, struct io_cancel);
7aaff708 JA	168	struct io_cancel_data cd = {
	169	.ctx = req->ctx,
	170	.data = cancel->addr,
	171	.flags = cancel->flags,
	172	.seq = atomic_inc_return(&req->ctx->cancel_seq),
	173	};
88f52eaa	174	struct io_uring_task *tctx = req->task->io_uring;
7aaff708 JA	175	int ret;
	176
	177	if (cd.flags & IORING_ASYNC_CANCEL_FD) {
7d8ca725 JA	178	if (req->flags & REQ_F_FIXED_FILE \|\|
	179	cd.flags & IORING_ASYNC_CANCEL_FD_FIXED) {
	180	req->flags \|= REQ_F_FIXED_FILE;
7aaff708 JA	181	req->file = io_file_get_fixed(req, cancel->fd,
7aaff708 JA	182	issue_flags);
7d8ca725	183	} else {
7aaff708	184	req->file = io_file_get_normal(req, cancel->fd);
7d8ca725	185	}
7aaff708 JA	186	if (!req->file) {
	187	ret = -EBADF;
	188	goto done;
	189	}
	190	cd.file = req->file;
	191	}
	192
88f52eaa	193	ret = __io_async_cancel(&cd, tctx, issue_flags);
7aaff708 JA	194	done:
	195	if (ret < 0)
	196	req_set_fail(req);
	197	io_req_set_res(req, ret, 0);
	198	return IOU_OK;
	199	}
38513c46	200
e6f89be6	201	void init_hash_table(struct io_hash_table *table, unsigned size)
38513c46 HX	202	{
	203	unsigned int i;
	204
	205	for (i = 0; i < size; i++) {
e6f89be6 PB	206	spin_lock_init(&table->hbs[i].lock);
e6f89be6 PB	207	INIT_HLIST_HEAD(&table->hbs[i].list);
38513c46 HX	208	}
38513c46 HX	209	}
78a861b9 JA	210
	211	static int __io_sync_cancel(struct io_uring_task *tctx,
	212	struct io_cancel_data *cd, int fd)
	213	{
	214	struct io_ring_ctx *ctx = cd->ctx;
	215
	216	/* fixed must be grabbed every time since we drop the uring_lock */
	217	if ((cd->flags & IORING_ASYNC_CANCEL_FD) &&
	218	(cd->flags & IORING_ASYNC_CANCEL_FD_FIXED)) {
47abea04	219	if (unlikely(fd >= ctx->nr_user_files))
78a861b9 JA	220	return -EBADF;
78a861b9 JA	221	fd = array_index_nospec(fd, ctx->nr_user_files);
60a666f0	222	cd->file = io_file_from_index(&ctx->file_table, fd);
78a861b9 JA	223	if (!cd->file)
	224	return -EBADF;
	225	}
	226
	227	return __io_async_cancel(cd, tctx, 0);
	228	}
	229
	230	int io_sync_cancel(struct io_ring_ctx ctx, void __user arg)
	231	__must_hold(&ctx->uring_lock)
	232	{
	233	struct io_cancel_data cd = {
	234	.ctx = ctx,
	235	.seq = atomic_inc_return(&ctx->cancel_seq),
	236	};
	237	ktime_t timeout = KTIME_MAX;
	238	struct io_uring_sync_cancel_reg sc;
	239	struct fd f = { };
	240	DEFINE_WAIT(wait);
	241	int ret;
	242
	243	if (copy_from_user(&sc, arg, sizeof(sc)))
	244	return -EFAULT;
	245	if (sc.flags & ~CANCEL_FLAGS)
	246	return -EINVAL;
	247	if (sc.pad[0] \|\| sc.pad[1] \|\| sc.pad[2] \|\| sc.pad[3])
	248	return -EINVAL;
	249
	250	cd.data = sc.addr;
	251	cd.flags = sc.flags;
	252
	253	/* we can grab a normal file descriptor upfront */
	254	if ((cd.flags & IORING_ASYNC_CANCEL_FD) &&
	255	!(cd.flags & IORING_ASYNC_CANCEL_FD_FIXED)) {
	256	f = fdget(sc.fd);
	257	if (!f.file)
	258	return -EBADF;
	259	cd.file = f.file;
	260	}
	261
	262	ret = __io_sync_cancel(current->io_uring, &cd, sc.fd);
	263
	264	/* found something, done! */
	265	if (ret != -EALREADY)
	266	goto out;
	267
	268	if (sc.timeout.tv_sec != -1UL \|\| sc.timeout.tv_nsec != -1UL) {
	269	struct timespec64 ts = {
	270	.tv_sec = sc.timeout.tv_sec,
	271	.tv_nsec = sc.timeout.tv_nsec
	272	};
	273
	274	timeout = ktime_add_ns(timespec64_to_ktime(ts), ktime_get_ns());
	275	}
	276
	277	/*
	278	* Keep looking until we get -ENOENT. we'll get woken everytime
	279	* every time a request completes and will retry the cancelation.
	280	*/
	281	do {
	282	cd.seq = atomic_inc_return(&ctx->cancel_seq);
	283
	284	prepare_to_wait(&ctx->cq_wait, &wait, TASK_INTERRUPTIBLE);
	285
	286	ret = __io_sync_cancel(current->io_uring, &cd, sc.fd);
287
23fffb2f	288	mutex_unlock(&ctx->uring_lock);
78a861b9 JA	289	if (ret != -EALREADY)
	290	break;
	291
c0e0d6ba	292	ret = io_run_task_work_sig(ctx);
23fffb2f	293	if (ret < 0)
78a861b9	294	break;
78a861b9	295	ret = schedule_hrtimeout(&timeout, HRTIMER_MODE_ABS);
78a861b9 JA	296	if (!ret) {
	297	ret = -ETIME;
	298	break;
	299	}
23fffb2f	300	mutex_lock(&ctx->uring_lock);
78a861b9 JA	301	} while (1);
	302
	303	finish_wait(&ctx->cq_wait, &wait);
23fffb2f	304	mutex_lock(&ctx->uring_lock);
78a861b9 JA	305
	306	if (ret == -ENOENT \|\| ret > 0)
	307	ret = 0;
	308	out:
	309	fdput(f);
	310	return ret;
	311	}