--- /dev/null
+From stable+bounces-114698-greg=kroah.com@vger.kernel.org Mon Feb 10 18:27:05 2025
+From: Pavel Begunkov <asml.silence@gmail.com>
+Date: Mon, 10 Feb 2025 17:27:55 +0000
+Subject: io_uring: fix io_req_prep_async with provided buffers
+To: stable@vger.kernel.org
+Cc: Muhammad Ramdhan <ramdhan@starlabs.sg>, Bing-Jhong Billy Jheng <billy@starlabs.sg>, Jacob Soo <jacob.soo@starlabs.sg>, Jens Axboe <axboe@kernel.dk>, Pavel Begunkov <asml.silence@gmail.com>
+Message-ID: <ecfd2314f89e04f39eca1b5642e34de82d6907ba.1739208415.git.asml.silence@gmail.com>
+
+From: Pavel Begunkov <asml.silence@gmail.com>
+
+io_req_prep_async() can import provided buffers, commit the ring state
+by giving up on that before, it'll be reimported later if needed.
+
+Reported-by: Muhammad Ramdhan <ramdhan@starlabs.sg>
+Reported-by: Bing-Jhong Billy Jheng <billy@starlabs.sg>
+Reported-by: Jacob Soo <jacob.soo@starlabs.sg>
+Fixes: c7fb19428d67d ("io_uring: add support for ring mapped supplied buffers")
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ io_uring/io_uring.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/io_uring/io_uring.c
++++ b/io_uring/io_uring.c
+@@ -1624,6 +1624,7 @@ bool io_alloc_async_data(struct io_kiocb
+ int io_req_prep_async(struct io_kiocb *req)
+ {
+ const struct io_op_def *def = &io_op_defs[req->opcode];
++ int ret;
+
+ /* assign early for deferred execution for non-fixed file */
+ if (def->needs_file && !(req->flags & REQ_F_FIXED_FILE) && !req->file)
+@@ -1636,7 +1637,9 @@ int io_req_prep_async(struct io_kiocb *r
+ if (io_alloc_async_data(req))
+ return -EAGAIN;
+ }
+- return def->prep_async(req);
++ ret = def->prep_async(req);
++ io_kbuf_recycle(req, 0);
++ return ret;
+ }
+
+ static u32 io_get_sequence(struct io_kiocb *req)
--- /dev/null
+From stable+bounces-114699-greg=kroah.com@vger.kernel.org Mon Feb 10 18:27:05 2025
+From: Pavel Begunkov <asml.silence@gmail.com>
+Date: Mon, 10 Feb 2025 17:27:54 +0000
+Subject: io_uring: fix multishots with selected buffers
+To: stable@vger.kernel.org
+Cc: Muhammad Ramdhan <ramdhan@starlabs.sg>, Bing-Jhong Billy Jheng <billy@starlabs.sg>, Jacob Soo <jacob.soo@starlabs.sg>, Jens Axboe <axboe@kernel.dk>, Pavel Begunkov <asml.silence@gmail.com>
+Message-ID: <2c95a69708e1e7f94acedc6286160160b7650bbb.1739208415.git.asml.silence@gmail.com>
+
+From: Pavel Begunkov <asml.silence@gmail.com>
+
+[ upstream commit d63b0e8a628e62ca85a0f7915230186bb92f8bb4 ]
+
+We do io_kbuf_recycle() when arming a poll but every iteration of a
+multishot can grab more buffers, which is why we need to flush the kbuf
+ring state before continuing with waiting.
+
+Cc: stable@vger.kernel.org
+Fixes: b3fdea6ecb55c ("io_uring: multishot recv")
+Reported-by: Muhammad Ramdhan <ramdhan@starlabs.sg>
+Reported-by: Bing-Jhong Billy Jheng <billy@starlabs.sg>
+Reported-by: Jacob Soo <jacob.soo@starlabs.sg>
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Link: https://lore.kernel.org/r/1bfc9990fe435f1fc6152ca9efeba5eb3e68339c.1738025570.git.asml.silence@gmail.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ io_uring/poll.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/io_uring/poll.c
++++ b/io_uring/poll.c
+@@ -307,6 +307,8 @@ static int io_poll_check_events(struct i
+ }
+ } else {
+ int ret = io_poll_issue(req, locked);
++ io_kbuf_recycle(req, 0);
++
+ if (ret == IOU_STOP_MULTISHOT)
+ return IOU_POLL_REMOVE_POLL_USE_RES;
+ if (ret < 0)
--- /dev/null
+From stable+bounces-114700-greg=kroah.com@vger.kernel.org Mon Feb 10 18:27:18 2025
+From: Pavel Begunkov <asml.silence@gmail.com>
+Date: Mon, 10 Feb 2025 17:27:56 +0000
+Subject: io_uring/rw: commit provided buffer state on async
+To: stable@vger.kernel.org
+Cc: Muhammad Ramdhan <ramdhan@starlabs.sg>, Bing-Jhong Billy Jheng <billy@starlabs.sg>, Jacob Soo <jacob.soo@starlabs.sg>, Jens Axboe <axboe@kernel.dk>, Pavel Begunkov <asml.silence@gmail.com>
+Message-ID: <71404cdcc823638709aa44ee2137cd444fc708ad.1739208415.git.asml.silence@gmail.com>
+
+From: Pavel Begunkov <asml.silence@gmail.com>
+
+When we get -EIOCBQUEUED, we need to ensure that the buffer is consumed
+from the provided buffer ring, which can be done with io_kbuf_recycle()
++ REQ_F_PARTIAL_IO.
+
+Reported-by: Muhammad Ramdhan <ramdhan@starlabs.sg>
+Reported-by: Bing-Jhong Billy Jheng <billy@starlabs.sg>
+Reported-by: Jacob Soo <jacob.soo@starlabs.sg>
+Fixes: c7fb19428d67d ("io_uring: add support for ring mapped supplied buffers")
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ io_uring/rw.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/io_uring/rw.c
++++ b/io_uring/rw.c
+@@ -772,6 +772,8 @@ static int __io_read(struct io_kiocb *re
+ goto done;
+ ret = 0;
+ } else if (ret == -EIOCBQUEUED) {
++ req->flags |= REQ_F_PARTIAL_IO;
++ io_kbuf_recycle(req, issue_flags);
+ if (iovec)
+ kfree(iovec);
+ return IOU_ISSUE_SKIP_COMPLETE;
+@@ -795,6 +797,9 @@ static int __io_read(struct io_kiocb *re
+ goto done;
+ }
+
++ req->flags |= REQ_F_PARTIAL_IO;
++ io_kbuf_recycle(req, issue_flags);
++
+ io = req->async_data;
+ s = &io->s;
+ /*
+@@ -935,6 +940,11 @@ int io_write(struct io_kiocb *req, unsig
+ else
+ ret2 = -EINVAL;
+
++ if (ret2 == -EIOCBQUEUED) {
++ req->flags |= REQ_F_PARTIAL_IO;
++ io_kbuf_recycle(req, issue_flags);
++ }
++
+ if (req->flags & REQ_F_REISSUE) {
+ req->flags &= ~REQ_F_REISSUE;
+ ret2 = -EAGAIN;
pinctrl-samsung-fix-fwnode-refcount-cleanup-if-platform_get_irq_optional-fails.patch
ptp-ensure-info-enable-callback-is-always-set.patch
rtc-zynqmp-fix-optional-clock-name-property.patch
+io_uring-fix-multishots-with-selected-buffers.patch
+io_uring-fix-io_req_prep_async-with-provided-buffers.patch
+io_uring-rw-commit-provided-buffer-state-on-async.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
