6.6-stable patches

added patches:
	io_uring-fix-io_req_prep_async-with-provided-buffers.patch
	io_uring-rw-commit-provided-buffer-state-on-async.patch

diff --git a/queue-6.6/io_uring-fix-io_req_prep_async-with-provided-buffers.patch b/queue-6.6/io_uring-fix-io_req_prep_async-with-provided-buffers.patch
new file mode 100644 (file)
index 0000000..28b746e
--- /dev/null
+++ b/queue-6.6/io_uring-fix-io_req_prep_async-with-provided-buffers.patch
@@ -0,0 +1,44 @@
+From stable+bounces-114677-greg=kroah.com@vger.kernel.org Mon Feb 10 16:22:12 2025
+From: Pavel Begunkov <asml.silence@gmail.com>
+Date: Mon, 10 Feb 2025 15:21:37 +0000
+Subject: io_uring: fix io_req_prep_async with provided buffers
+To: stable@vger.kernel.org
+Cc: Muhammad Ramdhan <ramdhan@starlabs.sg>, Bing-Jhong Billy Jheng <billy@starlabs.sg>, Jacob Soo <jacob.soo@starlabs.sg>, Jens Axboe <axboe@kernel.dk>, Pavel Begunkov <asml.silence@gmail.com>
+Message-ID: <43e7344807e915edf9e7834275d1ff6e96bd376f.1738772087.git.asml.silence@gmail.com>
+
+From: Pavel Begunkov <asml.silence@gmail.com>
+
+io_req_prep_async() can import provided buffers, commit the ring state
+by giving up on that before, it'll be reimported later if needed.
+
+Reported-by: Muhammad Ramdhan <ramdhan@starlabs.sg>
+Reported-by: Bing-Jhong Billy Jheng <billy@starlabs.sg>
+Reported-by: Jacob Soo <jacob.soo@starlabs.sg>
+Fixes: c7fb19428d67d ("io_uring: add support for ring mapped supplied buffers")
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ io_uring/io_uring.c |    5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/io_uring/io_uring.c
++++ b/io_uring/io_uring.c
+@@ -1779,6 +1779,7 @@ int io_req_prep_async(struct io_kiocb *r
+ {
+       const struct io_cold_def *cdef = &io_cold_defs[req->opcode];
+       const struct io_issue_def *def = &io_issue_defs[req->opcode];
++      int ret;
+ 
+       /* assign early for deferred execution for non-fixed file */
+       if (def->needs_file && !(req->flags & REQ_F_FIXED_FILE) && !req->file)
+@@ -1791,7 +1792,9 @@ int io_req_prep_async(struct io_kiocb *r
+               if (io_alloc_async_data(req))
+                       return -EAGAIN;
+       }
+-      return cdef->prep_async(req);
++      ret = cdef->prep_async(req);
++      io_kbuf_recycle(req, 0);
++      return ret;
+ }
+ 
+ static u32 io_get_sequence(struct io_kiocb *req)

diff --git a/queue-6.6/io_uring-rw-commit-provided-buffer-state-on-async.patch b/queue-6.6/io_uring-rw-commit-provided-buffer-state-on-async.patch
new file mode 100644 (file)
index 0000000..017dd35
--- /dev/null
+++ b/queue-6.6/io_uring-rw-commit-provided-buffer-state-on-async.patch
@@ -0,0 +1,57 @@
+From stable+bounces-114678-greg=kroah.com@vger.kernel.org Mon Feb 10 16:22:17 2025
+From: Pavel Begunkov <asml.silence@gmail.com>
+Date: Mon, 10 Feb 2025 15:21:38 +0000
+Subject: io_uring/rw: commit provided buffer state on async
+To: stable@vger.kernel.org
+Cc: Muhammad Ramdhan <ramdhan@starlabs.sg>, Bing-Jhong Billy Jheng <billy@starlabs.sg>, Jacob Soo <jacob.soo@starlabs.sg>, Jens Axboe <axboe@kernel.dk>, Pavel Begunkov <asml.silence@gmail.com>
+Message-ID: <cb9ec75521cc59ee1ab3119d8d28a8697cd9cae1.1738772087.git.asml.silence@gmail.com>
+
+From: Pavel Begunkov <asml.silence@gmail.com>
+
+When we get -EIOCBQUEUED, we need to ensure that the buffer is consumed
+from the provided buffer ring, which can be done with io_kbuf_recycle()
++ REQ_F_PARTIAL_IO.
+
+Reported-by: Muhammad Ramdhan <ramdhan@starlabs.sg>
+Reported-by: Bing-Jhong Billy Jheng <billy@starlabs.sg>
+Reported-by: Jacob Soo <jacob.soo@starlabs.sg>
+Fixes: c7fb19428d67d ("io_uring: add support for ring mapped supplied buffers")
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ io_uring/rw.c |   10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/io_uring/rw.c
++++ b/io_uring/rw.c
+@@ -793,6 +793,8 @@ static int __io_read(struct io_kiocb *re
+                       goto done;
+               ret = 0;
+       } else if (ret == -EIOCBQUEUED) {
++              req->flags |= REQ_F_PARTIAL_IO;
++              io_kbuf_recycle(req, issue_flags);
+               if (iovec)
+                       kfree(iovec);
+               return IOU_ISSUE_SKIP_COMPLETE;
+@@ -816,6 +818,9 @@ static int __io_read(struct io_kiocb *re
+               goto done;
+       }
+ 
++      req->flags |= REQ_F_PARTIAL_IO;
++      io_kbuf_recycle(req, issue_flags);
++
+       io = req->async_data;
+       s = &io->s;
+       /*
+@@ -956,6 +961,11 @@ int io_write(struct io_kiocb *req, unsig
+       else
+               ret2 = -EINVAL;
+ 
++      if (ret2 == -EIOCBQUEUED) {
++              req->flags |= REQ_F_PARTIAL_IO;
++              io_kbuf_recycle(req, issue_flags);
++      }
++
+       if (req->flags & REQ_F_REISSUE) {
+               req->flags &= ~REQ_F_REISSUE;
+               ret2 = -EAGAIN;

diff --git a/queue-6.6/series b/queue-6.6/series
index 1d8563eff6ec9ef9fad90fc2d516d506a7dfa5b4..3aaeccdb1fbbb434d1ba3151f22187f9fe48f97e 100644 (file)
--- a/queue-6.6/series
+++ b/queue-6.6/series
@@ -225,6 +225,8 @@ nvmem-imx-ocotp-ele-fix-reading-from-non-zero-offset.patch
 nvmem-imx-ocotp-ele-set-word-length-to-1.patch
 io_uring-fix-multishots-with-selected-buffers.patch
 io_uring-net-don-t-retry-connect-operation-on-epollerr.patch
+io_uring-fix-io_req_prep_async-with-provided-buffers.patch
+io_uring-rw-commit-provided-buffer-state-on-async.patch
 vfio-platform-check-the-bounds-of-read-write-syscalls.patch
 selftests-mptcp-connect-f-no-reconnect.patch
 pnfs-flexfiles-retry-getting-layout-segment-for-reads.patch