io_uring/kbuf: remove pbuf ring refcounting

struct io_buffer_list refcounting was needed for RCU based sync with
mmap, now  we can kill it.

Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/4a9cc54bf0077bb2bf2f3daf917549ddd41080da.1732886067.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c
index 662e928cc3b0052859515bf837c337b80fbc631c..644f61445ec980d8a3bf4d0e876bf58f8d3f04a6 100644 (file)
--- a/io_uring/kbuf.c
+++ b/io_uring/kbuf.c
@@ -48,7 +48,6 @@ static int io_buffer_add_list(struct io_ring_ctx *ctx,
         * always under the ->uring_lock, but lookups from mmap do.
         */
        bl->bgid = bgid;
-       atomic_set(&bl->refs, 1);
        guard(mutex)(&ctx->mmap_lock);
        return xa_err(xa_store(&ctx->io_bl_xa, bgid, bl, GFP_KERNEL));
 }
@@ -385,12 +384,10 @@ static int __io_remove_buffers(struct io_ring_ctx *ctx,
        return i;
 }
 
-void io_put_bl(struct io_ring_ctx *ctx, struct io_buffer_list *bl)
+static void io_put_bl(struct io_ring_ctx *ctx, struct io_buffer_list *bl)
 {
-       if (atomic_dec_and_test(&bl->refs)) {
-               __io_remove_buffers(ctx, bl, -1U);
-               kfree(bl);
-       }
+       __io_remove_buffers(ctx, bl, -1U);
+       kfree(bl);
 }
 
 void io_destroy_buffers(struct io_ring_ctx *ctx)
@@ -804,10 +801,8 @@ struct io_buffer_list *io_pbuf_get_bl(struct io_ring_ctx *ctx,
 
        bl = xa_load(&ctx->io_bl_xa, bgid);
        /* must be a mmap'able buffer ring and have pages */
-       if (bl && bl->flags & IOBL_MMAP) {
-               if (atomic_inc_not_zero(&bl->refs))
-                       return bl;
-       }
+       if (bl && bl->flags & IOBL_MMAP)
+               return bl;
 
        return ERR_PTR(-EINVAL);
 }
@@ -817,7 +812,7 @@ int io_pbuf_mmap(struct file *file, struct vm_area_struct *vma)
        struct io_ring_ctx *ctx = file->private_data;
        loff_t pgoff = vma->vm_pgoff << PAGE_SHIFT;
        struct io_buffer_list *bl;
-       int bgid, ret;
+       int bgid;
 
        lockdep_assert_held(&ctx->mmap_lock);
 
@@ -826,7 +821,5 @@ int io_pbuf_mmap(struct file *file, struct vm_area_struct *vma)
        if (IS_ERR(bl))
                return PTR_ERR(bl);
 
-       ret = io_uring_mmap_pages(ctx, vma, bl->buf_pages, bl->buf_nr_pages);
-       io_put_bl(ctx, bl);
-       return ret;
+       return io_uring_mmap_pages(ctx, vma, bl->buf_pages, bl->buf_nr_pages);
 }

diff --git a/io_uring/kbuf.h b/io_uring/kbuf.h
index d5e4afcbfbb3d0f7e45050ea2d3921f44b2b276e..dff7444026a639e380385ed0dfef879d8a041a36 100644 (file)
--- a/io_uring/kbuf.h
+++ b/io_uring/kbuf.h
@@ -35,8 +35,6 @@ struct io_buffer_list {
        __u16 mask;
 
        __u16 flags;
-
-       atomic_t refs;
 };
 
 struct io_buffer {
@@ -83,7 +81,6 @@ void __io_put_kbuf(struct io_kiocb *req, int len, unsigned issue_flags);
 
 bool io_kbuf_recycle_legacy(struct io_kiocb *req, unsigned issue_flags);
 
-void io_put_bl(struct io_ring_ctx *ctx, struct io_buffer_list *bl);
 struct io_buffer_list *io_pbuf_get_bl(struct io_ring_ctx *ctx,
                                      unsigned long bgid);
 int io_pbuf_mmap(struct file *file, struct vm_area_struct *vma);

diff --git a/io_uring/memmap.c b/io_uring/memmap.c
index 668b1c3579a2dbd2224f98578bcf3d152f815a94..73b73f4ea1bd4b6af1e07b8af23418cc3f1e2a35 100644 (file)
--- a/io_uring/memmap.c
+++ b/io_uring/memmap.c
@@ -383,7 +383,6 @@ static void *io_uring_validate_mmap_request(struct file *file, loff_t pgoff,
                if (IS_ERR(bl))
                        return bl;
                ptr = bl->buf_ring;
-               io_put_bl(ctx, bl);
                return ptr;
                }
        case IORING_MAP_OFF_PARAM_REGION: