From: Greg Kroah-Hartman Date: Mon, 15 Jun 2026 15:33:57 +0000 (+0200) Subject: 6.12-stable patches X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=52226c275c7c2cde77407cabe6faf1d8523c6b12;p=thirdparty%2Fkernel%2Fstable-queue.git 6.12-stable patches added patches: io_uring-kbuf-don-t-truncate-end-buffer-for-bundles.patch io_uring-wait-fix-min_timeout-behavior.patch --- diff --git a/queue-6.12/io_uring-kbuf-don-t-truncate-end-buffer-for-bundles.patch b/queue-6.12/io_uring-kbuf-don-t-truncate-end-buffer-for-bundles.patch new file mode 100644 index 0000000000..a62e7af827 --- /dev/null +++ b/queue-6.12/io_uring-kbuf-don-t-truncate-end-buffer-for-bundles.patch @@ -0,0 +1,43 @@ +From ca484a3b95420b2841539b9bc5143507929ead0a Mon Sep 17 00:00:00 2001 +From: Jens Axboe +Date: Sun, 7 Jun 2026 16:05:47 -0600 +Subject: io_uring/kbuf: don't truncate end buffer for bundles + +From: Jens Axboe + +Commit 70f4886bcbb929e88038c8807f1daf7fc587ae7c upstream. + +If buffers have been peeked for a bundle receive, the kernel will +truncate the end buffer, if the available length is shorter than the +buffer itself. This is unnecessary, as applications iterating bundle +receives must always use the minimum size of the buffer length and the +remaining number of bytes in the bundle. The examples in liburing do +that as well, eg examples/proxy.c. + +If the kernel does truncate this buffer AND the current transfer fails, +then the buffer will be left with a smaller size than what is otherwise +available. + +Just remove the buffer truncation, as it's not necessary in the first +place. + +Link: https://lore.kernel.org/io-uring/CAAEr8jbY60noGj1fw_k91UJRBkyiRVoS6=nLhZ7Svwidjn4CAA@mail.gmail.com/ +Reported-by: Federico Brasili +Cc: stable@vger.kernel.org +Fixes: 35c8711c8fc4 ("io_uring/kbuf: add helpers for getting/peeking multiple buffers") +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + io_uring/kbuf.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/io_uring/kbuf.c ++++ b/io_uring/kbuf.c +@@ -293,7 +293,6 @@ static int io_ring_buffers_peek(struct i + arg->partial_map = 1; + if (iov != arg->iovs) + break; +- WRITE_ONCE(buf->len, len); + } + } + diff --git a/queue-6.12/io_uring-wait-fix-min_timeout-behavior.patch b/queue-6.12/io_uring-wait-fix-min_timeout-behavior.patch new file mode 100644 index 0000000000..00938a9110 --- /dev/null +++ b/queue-6.12/io_uring-wait-fix-min_timeout-behavior.patch @@ -0,0 +1,37 @@ +From e68b3e06b410a794322c65449e4357889a5e3e4f Mon Sep 17 00:00:00 2001 +From: "Christian A. Ehrhardt" +Date: Sat, 6 Jun 2026 22:11:20 +0200 +Subject: io_uring/wait: fix min_timeout behavior + +From: "Christian A. Ehrhardt" + +Commit 29fe1bd01b99714f3136f922230a643c2742cda9 upstream. + +The wakeup condition if a min timeout is present and has expired is that +at least _one_ CQE was posted. Thus set the cq_tail target to +->cq_min_tail + 1. Without this commit a spurious wakeup can result in a +premature wakeup because io_should_wake() will return true even if _no_ +CQE was posted at all. + +Cc: Tip ten Brink +Fixes: e15cb2200b93 ("io_uring: fix min_wait wakeups for SQPOLL") +Cc: stable@vger.kernel.org +Signed-off-by: Christian A. Ehrhardt +Link: https://patch.msgid.link/20260606201120.1441447-1-lk@c--e.de +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + io_uring/io_uring.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/io_uring/io_uring.c ++++ b/io_uring/io_uring.c +@@ -2414,7 +2414,7 @@ static enum hrtimer_restart io_cqring_mi + } + + /* any generated CQE posted past this time should wake us up */ +- iowq->cq_tail = iowq->cq_min_tail; ++ iowq->cq_tail = iowq->cq_min_tail + 1; + + iowq->t.function = io_cqring_timer_wakeup; + hrtimer_set_expires(timer, iowq->timeout); diff --git a/queue-6.12/series b/queue-6.12/series index 26aa688b80..f239b73be1 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -186,3 +186,5 @@ net-rds-clear-i_sends-on-setup-unwind.patch nvmem-core-fix-use-after-free-bugs-in-error-paths.patch nvmem-layouts-onie-tlv-fix-hang-on-unknown-types.patch octeontx2-af-fix-memory-leak-in-rvu_setup_hw_resources.patch +io_uring-kbuf-don-t-truncate-end-buffer-for-bundles.patch +io_uring-wait-fix-min_timeout-behavior.patch