From: Greg Kroah-Hartman Date: Mon, 15 Jun 2026 15:33:58 +0000 (+0200) Subject: 6.18-stable patches X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=e46a0050a5c10b242d79fadde50a9adb212a3f41;p=thirdparty%2Fkernel%2Fstable-queue.git 6.18-stable patches added patches: io_uring-kbuf-don-t-truncate-end-buffer-for-bundles.patch io_uring-wait-fix-min_timeout-behavior.patch --- diff --git a/queue-6.18/io_uring-kbuf-don-t-truncate-end-buffer-for-bundles.patch b/queue-6.18/io_uring-kbuf-don-t-truncate-end-buffer-for-bundles.patch new file mode 100644 index 0000000000..b88d1e2318 --- /dev/null +++ b/queue-6.18/io_uring-kbuf-don-t-truncate-end-buffer-for-bundles.patch @@ -0,0 +1,43 @@ +From b01e74c189cc3e17fbb98f28f69245b259144429 Mon Sep 17 00:00:00 2001 +From: Jens Axboe +Date: Sun, 7 Jun 2026 16:05:47 -0600 +Subject: io_uring/kbuf: don't truncate end buffer for bundles + +From: Jens Axboe + +Commit 70f4886bcbb929e88038c8807f1daf7fc587ae7c upstream. + +If buffers have been peeked for a bundle receive, the kernel will +truncate the end buffer, if the available length is shorter than the +buffer itself. This is unnecessary, as applications iterating bundle +receives must always use the minimum size of the buffer length and the +remaining number of bytes in the bundle. The examples in liburing do +that as well, eg examples/proxy.c. + +If the kernel does truncate this buffer AND the current transfer fails, +then the buffer will be left with a smaller size than what is otherwise +available. + +Just remove the buffer truncation, as it's not necessary in the first +place. + +Link: https://lore.kernel.org/io-uring/CAAEr8jbY60noGj1fw_k91UJRBkyiRVoS6=nLhZ7Svwidjn4CAA@mail.gmail.com/ +Reported-by: Federico Brasili +Cc: stable@vger.kernel.org +Fixes: 35c8711c8fc4 ("io_uring/kbuf: add helpers for getting/peeking multiple buffers") +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + io_uring/kbuf.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/io_uring/kbuf.c ++++ b/io_uring/kbuf.c +@@ -305,7 +305,6 @@ static int io_ring_buffers_peek(struct i + arg->partial_map = 1; + if (iov != arg->iovs) + break; +- buf->len = len; + } + } + diff --git a/queue-6.18/io_uring-wait-fix-min_timeout-behavior.patch b/queue-6.18/io_uring-wait-fix-min_timeout-behavior.patch new file mode 100644 index 0000000000..9522019a46 --- /dev/null +++ b/queue-6.18/io_uring-wait-fix-min_timeout-behavior.patch @@ -0,0 +1,37 @@ +From f3bdf56a5b1677153d7ff38e0a2a69c87bc50f7c Mon Sep 17 00:00:00 2001 +From: "Christian A. Ehrhardt" +Date: Sat, 6 Jun 2026 22:11:20 +0200 +Subject: io_uring/wait: fix min_timeout behavior + +From: "Christian A. Ehrhardt" + +Commit 29fe1bd01b99714f3136f922230a643c2742cda9 upstream. + +The wakeup condition if a min timeout is present and has expired is that +at least _one_ CQE was posted. Thus set the cq_tail target to +->cq_min_tail + 1. Without this commit a spurious wakeup can result in a +premature wakeup because io_should_wake() will return true even if _no_ +CQE was posted at all. + +Cc: Tip ten Brink +Fixes: e15cb2200b93 ("io_uring: fix min_wait wakeups for SQPOLL") +Cc: stable@vger.kernel.org +Signed-off-by: Christian A. Ehrhardt +Link: https://patch.msgid.link/20260606201120.1441447-1-lk@c--e.de +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + io_uring/io_uring.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/io_uring/io_uring.c ++++ b/io_uring/io_uring.c +@@ -2586,7 +2586,7 @@ static enum hrtimer_restart io_cqring_mi + } + + /* any generated CQE posted past this time should wake us up */ +- iowq->cq_tail = iowq->cq_min_tail; ++ iowq->cq_tail = iowq->cq_min_tail + 1; + + hrtimer_update_function(&iowq->t, io_cqring_timer_wakeup); + hrtimer_set_expires(timer, iowq->timeout); diff --git a/queue-6.18/series b/queue-6.18/series index 7d0afba7dc..31b7fc9709 100644 --- a/queue-6.18/series +++ b/queue-6.18/series @@ -244,3 +244,5 @@ nvmem-core-fix-use-after-free-bugs-in-error-paths.patch nvmem-layouts-onie-tlv-fix-hang-on-unknown-types.patch octeontx2-af-fix-memory-leak-in-rvu_setup_hw_resources.patch pinctrl-mcp23s08-read-spi-present-mask-as-u8-not-u32.patch +io_uring-kbuf-don-t-truncate-end-buffer-for-bundles.patch +io_uring-wait-fix-min_timeout-behavior.patch