From: Greg Kroah-Hartman Date: Fri, 15 May 2026 09:18:09 +0000 (+0200) Subject: 6.18-stable patches X-Git-Tag: v5.10.256~10 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=01db3919f070cb136140409e43d117e107aeed0c;p=thirdparty%2Fkernel%2Fstable-queue.git 6.18-stable patches added patches: io_uring-zcrx-use-guards-for-locking.patch io_uring-zcrx-warn-on-freelist-violations.patch --- diff --git a/queue-6.18/io_uring-zcrx-use-guards-for-locking.patch b/queue-6.18/io_uring-zcrx-use-guards-for-locking.patch new file mode 100644 index 0000000000..d053074139 --- /dev/null +++ b/queue-6.18/io_uring-zcrx-use-guards-for-locking.patch @@ -0,0 +1,67 @@ +From 898ad80d1207cbdb22b21bafb6de4adfd7627bd0 Mon Sep 17 00:00:00 2001 +From: Pavel Begunkov +Date: Mon, 23 Mar 2026 12:43:57 +0000 +Subject: io_uring/zcrx: use guards for locking + +From: Pavel Begunkov + +commit 898ad80d1207cbdb22b21bafb6de4adfd7627bd0 upstream. + +Convert last several places using manual locking to guards to simplify +the code. + +Signed-off-by: Pavel Begunkov +Link: https://patch.msgid.link/eb4667cfaf88c559700f6399da9e434889f5b04a.1774261953.git.asml.silence@gmail.com +Signed-off-by: Jens Axboe +Signed-off-by: Harshit Mogalapalli +Signed-off-by: Greg Kroah-Hartman +--- + io_uring/zcrx.c | 15 +++++++-------- + 1 file changed, 7 insertions(+), 8 deletions(-) + +--- a/io_uring/zcrx.c ++++ b/io_uring/zcrx.c +@@ -696,9 +696,8 @@ static void io_zcrx_return_niov_freelist + { + struct io_zcrx_area *area = io_zcrx_iov_to_area(niov); + +- spin_lock_bh(&area->freelist_lock); ++ guard(spinlock_bh)(&area->freelist_lock); + area->freelist[area->free_count++] = net_iov_idx(niov); +- spin_unlock_bh(&area->freelist_lock); + } + + static void io_zcrx_return_niov(struct net_iov *niov) +@@ -829,7 +828,8 @@ static void io_zcrx_refill_slow(struct p + { + struct io_zcrx_area *area = ifq->area; + +- spin_lock_bh(&area->freelist_lock); ++ guard(spinlock_bh)(&area->freelist_lock); ++ + while (area->free_count && pp->alloc.count < PP_ALLOC_CACHE_REFILL) { + struct net_iov *niov = __io_zcrx_get_free_niov(area); + netmem_ref netmem = net_iov_to_netmem(niov); +@@ -838,7 +838,6 @@ static void io_zcrx_refill_slow(struct p + io_zcrx_sync_for_device(pp, niov); + net_mp_netmem_place_in_cache(pp, netmem); + } +- spin_unlock_bh(&area->freelist_lock); + } + + static netmem_ref io_pp_zc_alloc_netmems(struct page_pool *pp, gfp_t gfp) +@@ -975,10 +974,10 @@ static struct net_iov *io_alloc_fallback + if (area->mem.is_dmabuf) + return NULL; + +- spin_lock_bh(&area->freelist_lock); +- if (area->free_count) +- niov = __io_zcrx_get_free_niov(area); +- spin_unlock_bh(&area->freelist_lock); ++ scoped_guard(spinlock_bh, &area->freelist_lock) { ++ if (area->free_count) ++ niov = __io_zcrx_get_free_niov(area); ++ } + + if (niov) + page_pool_fragment_netmem(net_iov_to_netmem(niov), 1); diff --git a/queue-6.18/io_uring-zcrx-warn-on-freelist-violations.patch b/queue-6.18/io_uring-zcrx-warn-on-freelist-violations.patch new file mode 100644 index 0000000000..bda0866d38 --- /dev/null +++ b/queue-6.18/io_uring-zcrx-warn-on-freelist-violations.patch @@ -0,0 +1,34 @@ +From 770594e78c3964cf23cf5287f849437cdde9b7d0 Mon Sep 17 00:00:00 2001 +From: Pavel Begunkov +Date: Tue, 21 Apr 2026 09:45:29 +0100 +Subject: io_uring/zcrx: warn on freelist violations + +From: Pavel Begunkov + +commit 770594e78c3964cf23cf5287f849437cdde9b7d0 upstream. + +The freelist is appropriately sized to always be able to take a free +niov, but let's be more defensive and check the invariant with a +warning. That should help to catch any double-free issues. + +Suggested-by: Kai Aizen +Signed-off-by: Pavel Begunkov +Link: https://patch.msgid.link/2f3cea363b04649755e3b6bb9ab66485a95936d5.1776760901.git.asml.silence@gmail.com +Signed-off-by: Jens Axboe +Signed-off-by: Harshit Mogalapalli +Signed-off-by: Greg Kroah-Hartman +--- + io_uring/zcrx.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/io_uring/zcrx.c ++++ b/io_uring/zcrx.c +@@ -697,6 +697,8 @@ static void io_zcrx_return_niov_freelist + struct io_zcrx_area *area = io_zcrx_iov_to_area(niov); + + guard(spinlock_bh)(&area->freelist_lock); ++ if (WARN_ON_ONCE(area->free_count >= area->nia.num_niovs)) ++ return; + area->freelist[area->free_count++] = net_iov_idx(niov); + } + diff --git a/queue-6.18/series b/queue-6.18/series index cfc2cb8daf..876fb5a108 100644 --- a/queue-6.18/series +++ b/queue-6.18/series @@ -142,3 +142,5 @@ batman-adv-bla-prevent-use-after-free-when-deleting-claims.patch batman-adv-bla-only-purge-non-released-claims.patch batman-adv-bla-put-backbone-reference-on-failed-claim-hash-insert.patch sched_ext-use-hk_type_domain_boot-to-detect-isolcpus-domain-isolation.patch +io_uring-zcrx-use-guards-for-locking.patch +io_uring-zcrx-warn-on-freelist-violations.patch