6.11-stable patches

added patches:
	io_uring-rw-fix-cflags-posting-for-single-issue-multishot-read.patch

diff --git a/queue-6.11/io_uring-rw-fix-cflags-posting-for-single-issue-multishot-read.patch b/queue-6.11/io_uring-rw-fix-cflags-posting-for-single-issue-multishot-read.patch
new file mode 100644 (file)
index 0000000..e279def
--- /dev/null
+++ b/queue-6.11/io_uring-rw-fix-cflags-posting-for-single-issue-multishot-read.patch
@@ -0,0 +1,66 @@
+From c5bada95115a2515fdc30d8675db628cfa31e4b7 Mon Sep 17 00:00:00 2001
+From: Jens Axboe <axboe@kernel.dk>
+Date: Sat, 5 Oct 2024 19:06:50 -0600
+Subject: io_uring/rw: fix cflags posting for single issue multishot read
+
+From: Jens Axboe <axboe@kernel.dk>
+
+Commit c9d952b9103b600ddafc5d1c0e2f2dbd30f0b805 upstream.
+
+If multishot gets disabled, and hence the request will get terminated
+rather than persist for more iterations, then posting the CQE with the
+right cflags is still important. Most notably, the buffer reference
+needs to be included.
+
+Refactor the return of __io_read() a bit, so that the provided buffer
+is always put correctly, and hence returned to the application.
+
+Reported-by: Sharon Rosner <Sharon Rosner>
+Link: https://github.com/axboe/liburing/issues/1257
+Cc: stable@vger.kernel.org
+Fixes: 2a975d426c82 ("io_uring/rw: don't allow multishot reads without NOWAIT support")
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ io_uring/rw.c |   19 ++++++++++++-------
+ 1 file changed, 12 insertions(+), 7 deletions(-)
+
+--- a/io_uring/rw.c
++++ b/io_uring/rw.c
+@@ -973,17 +973,21 @@ int io_read_mshot(struct io_kiocb *req,
+               if (issue_flags & IO_URING_F_MULTISHOT)
+                       return IOU_ISSUE_SKIP_COMPLETE;
+               return -EAGAIN;
+-      }
+-
+-      /*
+-       * Any successful return value will keep the multishot read armed.
+-       */
+-      if (ret > 0 && req->flags & REQ_F_APOLL_MULTISHOT) {
++      } else if (ret <= 0) {
++              io_kbuf_recycle(req, issue_flags);
++              if (ret < 0)
++                      req_set_fail(req);
++      } else {
+               /*
+-               * Put our buffer and post a CQE. If we fail to post a CQE, then
++               * Any successful return value will keep the multishot read
++               * armed, if it's still set. Put our buffer and post a CQE. If
++               * we fail to post a CQE, or multishot is no longer set, then
+                * jump to the termination path. This request is then done.
+                */
+               cflags = io_put_kbuf(req, issue_flags);
++              if (!(req->flags & REQ_F_APOLL_MULTISHOT))
++                      goto done;
++
+               rw->len = 0; /* similarly to above, reset len to 0 */
+ 
+               if (io_req_post_cqe(req, ret, cflags | IORING_CQE_F_MORE)) {
+@@ -1004,6 +1008,7 @@ int io_read_mshot(struct io_kiocb *req,
+        * Either an error, or we've hit overflow posting the CQE. For any
+        * multishot request, hitting overflow will terminate it.
+        */
++done:
+       io_req_set_res(req, ret, cflags);
+       io_req_rw_cleanup(req, issue_flags);
+       if (issue_flags & IO_URING_F_MULTISHOT)

diff --git a/queue-6.11/series b/queue-6.11/series
index a1979452bce17f6d0ba755db763f2adf9b90d533..654722f558cda4103ba86b13878bcbe0ca3f72a2 100644 (file)
--- a/queue-6.11/series
+++ b/queue-6.11/series
@@ -211,3 +211,4 @@ kthread-unpark-only-parked-kthread.patch
 fs-proc-kcore.c-allow-translation-of-physical-memory-addresses.patch
 secretmem-disable-memfd_secret-if-arch-cannot-set-direct-map.patch
 pci-pass-domain-number-to-pci_bus_release_domain_nr-explicitly.patch
+io_uring-rw-fix-cflags-posting-for-single-issue-multishot-read.patch