]> git.ipfire.org Git - thirdparty/linux.git/blame - io_uring/io_uring.h
io_uring/net: fix UAF in io_sendrecv_fail()
[thirdparty/linux.git] / io_uring / io_uring.h
CommitLineData
de23077e
JA
1#ifndef IOU_CORE_H
2#define IOU_CORE_H
3
4#include <linux/errno.h>
cd40cae2 5#include <linux/lockdep.h>
ab1c84d8
PB
6#include <linux/io_uring_types.h>
7#include "io-wq.h"
a6b21fbb 8#include "slist.h"
ab1c84d8 9#include "filetable.h"
de23077e 10
f3b44f92
JA
11#ifndef CREATE_TRACE_POINTS
12#include <trace/events/io_uring.h>
13#endif
14
97b388d7
JA
15enum {
16 IOU_OK = 0,
17 IOU_ISSUE_SKIP_COMPLETE = -EIOCBQUEUED,
114eccdf
DY
18
19 /*
20 * Intended only when both REQ_F_POLLED and REQ_F_APOLL_MULTISHOT
21 * are set to indicate to the poll runner that multishot should be
22 * removed and the result is set on req->cqe.res.
23 */
24 IOU_STOP_MULTISHOT = -ECANCELED,
97b388d7
JA
25};
26
faf88dde 27struct io_uring_cqe *__io_get_cqe(struct io_ring_ctx *ctx);
68494a65 28bool io_req_cqe_overflow(struct io_kiocb *req);
c0e0d6ba 29int io_run_task_work_sig(struct io_ring_ctx *ctx);
8ac5d85a 30int __io_run_local_work(struct io_ring_ctx *ctx, bool locked);
c0e0d6ba 31int io_run_local_work(struct io_ring_ctx *ctx);
9046c641
PB
32void io_req_complete_failed(struct io_kiocb *req, s32 res);
33void __io_req_complete(struct io_kiocb *req, unsigned issue_flags);
34void io_req_complete_post(struct io_kiocb *req);
35void __io_req_complete_post(struct io_kiocb *req);
52120f0f
DY
36bool io_post_aux_cqe(struct io_ring_ctx *ctx, u64 user_data, s32 res, u32 cflags,
37 bool allow_overflow);
eb42cebb
PB
38bool io_fill_cqe_aux(struct io_ring_ctx *ctx, u64 user_data, s32 res, u32 cflags,
39 bool allow_overflow);
9046c641
PB
40void __io_commit_cqring_flush(struct io_ring_ctx *ctx);
41
42struct page **io_pin_pages(unsigned long ubuf, unsigned long len, int *npages);
43
44struct file *io_file_get_normal(struct io_kiocb *req, int fd);
45struct file *io_file_get_fixed(struct io_kiocb *req, int fd,
46 unsigned issue_flags);
47
f6b543fd
JA
48static inline bool io_req_ffs_set(struct io_kiocb *req)
49{
50 return req->flags & REQ_F_FIXED_FILE;
51}
52
9046c641
PB
53bool io_is_uring_fops(struct file *file);
54bool io_alloc_async_data(struct io_kiocb *req);
55void io_req_task_work_add(struct io_kiocb *req);
9046c641
PB
56void io_req_tw_post_queue(struct io_kiocb *req, s32 res, u32 cflags);
57void io_req_task_queue(struct io_kiocb *req);
58void io_queue_iowq(struct io_kiocb *req, bool *dont_use);
59void io_req_task_complete(struct io_kiocb *req, bool *locked);
60void io_req_task_queue_fail(struct io_kiocb *req, int ret);
61void io_req_task_submit(struct io_kiocb *req, bool *locked);
62void tctx_task_work(struct callback_head *cb);
63__cold void io_uring_cancel_generic(bool cancel_all, struct io_sq_data *sqd);
64int io_uring_alloc_task_context(struct task_struct *task,
65 struct io_ring_ctx *ctx);
66
67int io_poll_issue(struct io_kiocb *req, bool *locked);
68int io_submit_sqes(struct io_ring_ctx *ctx, unsigned int nr);
69int io_do_iopoll(struct io_ring_ctx *ctx, bool force_nonspin);
70void io_free_batch_list(struct io_ring_ctx *ctx, struct io_wq_work_node *node);
71int io_req_prep_async(struct io_kiocb *req);
72
73struct io_wq_work *io_wq_free_work(struct io_wq_work *work);
74void io_wq_submit_work(struct io_wq_work *work);
75
76void io_free_req(struct io_kiocb *req);
77void io_queue_next(struct io_kiocb *req);
e70cb608 78void __io_put_task(struct task_struct *task, int nr);
63809137 79void io_task_refs_refill(struct io_uring_task *tctx);
bd1a3783 80bool __io_alloc_req_refill(struct io_ring_ctx *ctx);
9046c641
PB
81
82bool io_match_task_safe(struct io_kiocb *head, struct task_struct *task,
83 bool cancel_all);
84
85#define io_for_each_link(pos, head) \
86 for (pos = (head); pos; pos = pos->link)
f3b44f92 87
25399321
PB
88static inline void io_cq_lock(struct io_ring_ctx *ctx)
89 __acquires(ctx->completion_lock)
90{
91 spin_lock(&ctx->completion_lock);
92}
93
94void io_cq_unlock_post(struct io_ring_ctx *ctx);
95
f3b44f92
JA
96static inline struct io_uring_cqe *io_get_cqe(struct io_ring_ctx *ctx)
97{
98 if (likely(ctx->cqe_cached < ctx->cqe_sentinel)) {
99 struct io_uring_cqe *cqe = ctx->cqe_cached;
100
f3b44f92
JA
101 ctx->cached_cq_tail++;
102 ctx->cqe_cached++;
b3659a65
PB
103 if (ctx->flags & IORING_SETUP_CQE32)
104 ctx->cqe_cached++;
f3b44f92
JA
105 return cqe;
106 }
107
108 return __io_get_cqe(ctx);
109}
110
111static inline bool __io_fill_cqe_req(struct io_ring_ctx *ctx,
112 struct io_kiocb *req)
113{
114 struct io_uring_cqe *cqe;
115
e8c328c3
PB
116 /*
117 * If we can't get a cq entry, userspace overflowed the
118 * submission (by quite a lot). Increment the overflow count in
119 * the ring.
120 */
121 cqe = io_get_cqe(ctx);
122 if (unlikely(!cqe))
123 return io_req_cqe_overflow(req);
e0486f3f
DY
124
125 trace_io_uring_complete(req->ctx, req, req->cqe.user_data,
126 req->cqe.res, req->cqe.flags,
127 (req->flags & REQ_F_CQE32_INIT) ? req->extra1 : 0,
128 (req->flags & REQ_F_CQE32_INIT) ? req->extra2 : 0);
129
e8c328c3
PB
130 memcpy(cqe, &req->cqe, sizeof(*cqe));
131
132 if (ctx->flags & IORING_SETUP_CQE32) {
f3b44f92
JA
133 u64 extra1 = 0, extra2 = 0;
134
135 if (req->flags & REQ_F_CQE32_INIT) {
136 extra1 = req->extra1;
137 extra2 = req->extra2;
138 }
139
e8c328c3
PB
140 WRITE_ONCE(cqe->big_cqe[0], extra1);
141 WRITE_ONCE(cqe->big_cqe[1], extra2);
f3b44f92 142 }
e8c328c3 143 return true;
f3b44f92
JA
144}
145
531113bb
JA
146static inline void req_set_fail(struct io_kiocb *req)
147{
148 req->flags |= REQ_F_FAIL;
149 if (req->flags & REQ_F_CQE_SKIP) {
150 req->flags &= ~REQ_F_CQE_SKIP;
151 req->flags |= REQ_F_SKIP_LINK_CQES;
152 }
153}
154
de23077e
JA
155static inline void io_req_set_res(struct io_kiocb *req, s32 res, u32 cflags)
156{
157 req->cqe.res = res;
158 req->cqe.flags = cflags;
159}
160
99f15d8d
JA
161static inline bool req_has_async_data(struct io_kiocb *req)
162{
163 return req->flags & REQ_F_ASYNC_DATA;
164}
165
531113bb
JA
166static inline void io_put_file(struct file *file)
167{
168 if (file)
169 fput(file);
170}
171
cd40cae2
JA
172static inline void io_ring_submit_unlock(struct io_ring_ctx *ctx,
173 unsigned issue_flags)
174{
175 lockdep_assert_held(&ctx->uring_lock);
176 if (issue_flags & IO_URING_F_UNLOCKED)
177 mutex_unlock(&ctx->uring_lock);
178}
179
180static inline void io_ring_submit_lock(struct io_ring_ctx *ctx,
181 unsigned issue_flags)
182{
183 /*
184 * "Normal" inline submissions always hold the uring_lock, since we
185 * grab it from the system call. Same is true for the SQPOLL offload.
186 * The only exception is when we've detached the request and issue it
187 * from an async worker thread, grab the lock for that case.
188 */
189 if (issue_flags & IO_URING_F_UNLOCKED)
190 mutex_lock(&ctx->uring_lock);
191 lockdep_assert_held(&ctx->uring_lock);
192}
193
f9ead18c
JA
194static inline void io_commit_cqring(struct io_ring_ctx *ctx)
195{
196 /* order cqe stores with ring update */
197 smp_store_release(&ctx->rings->cq.tail, ctx->cached_cq_tail);
198}
199
f3b44f92
JA
200static inline void io_cqring_wake(struct io_ring_ctx *ctx)
201{
202 /*
203 * wake_up_all() may seem excessive, but io_wake_function() and
204 * io_should_wake() handle the termination of the loop and only
205 * wake as many waiters as we need to.
206 */
207 if (wq_has_sleeper(&ctx->cq_wait))
208 wake_up_all(&ctx->cq_wait);
209}
210
17437f31
JA
211static inline bool io_sqring_full(struct io_ring_ctx *ctx)
212{
213 struct io_rings *r = ctx->rings;
214
215 return READ_ONCE(r->sq.tail) - ctx->cached_sq_head == ctx->sq_entries;
216}
217
218static inline unsigned int io_sqring_entries(struct io_ring_ctx *ctx)
219{
220 struct io_rings *rings = ctx->rings;
221
222 /* make sure SQ entry isn't read before tail */
223 return smp_load_acquire(&rings->sq.tail) - ctx->cached_sq_head;
224}
225
c0e0d6ba 226static inline int io_run_task_work(void)
17437f31 227{
625d38b3 228 if (test_thread_flag(TIF_NOTIFY_SIGNAL)) {
17437f31
JA
229 __set_current_state(TASK_RUNNING);
230 clear_notify_signal();
231 if (task_work_pending(current))
232 task_work_run();
c0e0d6ba 233 return 1;
17437f31
JA
234 }
235
c0e0d6ba
DY
236 return 0;
237}
238
dac6a0ea
JA
239static inline bool io_task_work_pending(struct io_ring_ctx *ctx)
240{
241 return test_thread_flag(TIF_NOTIFY_SIGNAL) ||
242 !wq_list_empty(&ctx->work_llist);
243}
244
c0e0d6ba
DY
245static inline int io_run_task_work_ctx(struct io_ring_ctx *ctx)
246{
247 int ret = 0;
248 int ret2;
249
250 if (ctx->flags & IORING_SETUP_DEFER_TASKRUN)
251 ret = io_run_local_work(ctx);
252
253 /* want to run this after in case more is added */
254 ret2 = io_run_task_work();
255
256 /* Try propagate error in favour of if tasks were run,
257 * but still make sure to run them if requested
258 */
259 if (ret >= 0)
260 ret += ret2;
261
262 return ret;
17437f31
JA
263}
264
aa1e90f6
PB
265static inline void io_tw_lock(struct io_ring_ctx *ctx, bool *locked)
266{
267 if (!*locked) {
268 mutex_lock(&ctx->uring_lock);
269 *locked = true;
270 }
271}
272
9da070b1
PB
273/*
274 * Don't complete immediately but use deferred completion infrastructure.
275 * Protected by ->uring_lock and can only be used either with
276 * IO_URING_F_COMPLETE_DEFER or inside a tw handler holding the mutex.
277 */
278static inline void io_req_complete_defer(struct io_kiocb *req)
279 __must_hold(&req->ctx->uring_lock)
aa1e90f6
PB
280{
281 struct io_submit_state *state = &req->ctx->submit_state;
282
9da070b1
PB
283 lockdep_assert_held(&req->ctx->uring_lock);
284
aa1e90f6
PB
285 wq_list_add_tail(&req->comp_list, &state->compl_reqs);
286}
287
46929b08
PB
288static inline void io_commit_cqring_flush(struct io_ring_ctx *ctx)
289{
290 if (unlikely(ctx->off_timeout_used || ctx->drain_active || ctx->has_evfd))
291 __io_commit_cqring_flush(ctx);
292}
293
e70cb608
PB
294/* must to be called somewhat shortly after putting a request */
295static inline void io_put_task(struct task_struct *task, int nr)
296{
297 if (likely(task == current))
298 task->io_uring->cached_refs += nr;
299 else
300 __io_put_task(task, nr);
301}
302
63809137
PB
303static inline void io_get_task_refs(int nr)
304{
305 struct io_uring_task *tctx = current->io_uring;
306
307 tctx->cached_refs -= nr;
308 if (unlikely(tctx->cached_refs < 0))
309 io_task_refs_refill(tctx);
310}
311
bd1a3783
PB
312static inline bool io_req_cache_empty(struct io_ring_ctx *ctx)
313{
314 return !ctx->submit_state.free_list.next;
315}
316
317static inline bool io_alloc_req_refill(struct io_ring_ctx *ctx)
318{
319 if (unlikely(io_req_cache_empty(ctx)))
320 return __io_alloc_req_refill(ctx);
321 return true;
322}
323
324static inline struct io_kiocb *io_alloc_req(struct io_ring_ctx *ctx)
325{
326 struct io_wq_work_node *node;
327
328 node = wq_stack_extract(&ctx->submit_state.free_list);
329 return container_of(node, struct io_kiocb, comp_list);
330}
331
76de6749
PB
332static inline bool io_allowed_run_tw(struct io_ring_ctx *ctx)
333{
6567506b
PB
334 return likely(!(ctx->flags & IORING_SETUP_DEFER_TASKRUN) ||
335 ctx->submitter_task == current);
76de6749
PB
336}
337
de23077e 338#endif