From: Greg Kroah-Hartman Date: Sat, 30 May 2026 10:31:19 +0000 (+0200) Subject: fix up some io_uring backports X-Git-Tag: v5.10.258~12 X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=5fcb5eaff819dd61778820fddaf21752d2496f16;p=thirdparty%2Fkernel%2Fstable-queue.git fix up some io_uring backports --- diff --git a/queue-5.10/io_uring-poll-fix-backport-of-io_poll_add-changes.patch b/queue-5.10/io_uring-poll-fix-backport-of-io_poll_add-changes.patch deleted file mode 100644 index 533a72d828..0000000000 --- a/queue-5.10/io_uring-poll-fix-backport-of-io_poll_add-changes.patch +++ /dev/null @@ -1,50 +0,0 @@ -From b2a09e4ac99fe6faa8536b44bde9366841147e76 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Tue, 21 Apr 2026 16:44:06 -0600 -Subject: io_uring/poll: fix backport of io_poll_add() changes - -From: Jens Axboe - -The 5.15/5.10 backport of 84230ad2d2af had a few issues, due to the -older poll base. Notably return value handling __io_arm_poll_handler() -and in return __io_poll_add() as well. Fix them up. - -Reported-by: Ben Hutchings -Fixes: 349ef5d2e7bf ("io_uring/poll: correctly handle io_poll_add() return value on update") -Signed-off-by: Jens Axboe -Signed-off-by: Sasha Levin ---- - io_uring/io_uring.c | 12 ++++-------- - 1 file changed, 4 insertions(+), 8 deletions(-) - -diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c -index 83806b3c6e3bc..8b0dfea96ee09 100644 ---- a/io_uring/io_uring.c -+++ b/io_uring/io_uring.c -@@ -5991,19 +5991,15 @@ static int __io_poll_add(struct io_kiocb *req, unsigned int issue_flags) - if (!ret && ipt.error) - req_set_fail(req); - ret = ret ?: ipt.error; -- if (ret > 0) { -+ if (ret) - __io_req_complete(req, issue_flags, ret, 0); -- return ret; -- } -- return 0; -+ return ret; - } - - static int io_poll_add(struct io_kiocb *req, unsigned int issue_flags) - { -- int ret; -- -- ret = __io_poll_add(req, issue_flags); -- return ret < 0 ? ret : 0; -+ __io_poll_add(req, issue_flags); -+ return 0; - } - - static int io_poll_update(struct io_kiocb *req, unsigned int issue_flags) --- -2.53.0 - diff --git a/queue-5.10/io_uring-poll-fix-epoll_uring_wake-sometimes-not-bei.patch b/queue-5.10/io_uring-poll-fix-epoll_uring_wake-sometimes-not-bei.patch deleted file mode 100644 index 4ca51624ac..0000000000 --- a/queue-5.10/io_uring-poll-fix-epoll_uring_wake-sometimes-not-bei.patch +++ /dev/null @@ -1,50 +0,0 @@ -From 8b163d0ce867c89f430db36a4ffbc1d2238dec3f Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Tue, 21 Apr 2026 16:41:32 -0600 -Subject: io_uring/poll: fix EPOLL_URING_WAKE sometimes not being masked in - -From: Jens Axboe - -Rather than do it only when we jump straight to execution, mark it -regardless. This ensures it doesn't get lost. - -Fixes: ccf06b5a981c ("io_uring: pass in EPOLL_URING_WAKE for eventfd signaling and wakeups") -Signed-off-by: Jens Axboe -Signed-off-by: Sasha Levin ---- - io_uring/io_uring.c | 17 ++++++++--------- - 1 file changed, 8 insertions(+), 9 deletions(-) - -diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c -index dea1fb22c0efb..83806b3c6e3bc 100644 ---- a/io_uring/io_uring.c -+++ b/io_uring/io_uring.c -@@ -5647,17 +5647,16 @@ static int io_poll_wake(struct wait_queue_entry *wait, unsigned mode, int sync, - if (mask && !(mask & poll->events)) - return 0; - -- if (io_poll_get_ownership(req)) { -- /* -- * If we trigger a multishot poll off our own wakeup path, -- * disable multishot as there is a circular dependency between -- * CQ posting and triggering the event. -- */ -- if (mask & EPOLL_URING_WAKE) -- poll->events |= EPOLLONESHOT; -+ /* -+ * If we trigger a multishot poll off our own wakeup path, -+ * disable multishot as there is a circular dependency between -+ * CQ posting and triggering the event. -+ */ -+ if (mask & EPOLL_URING_WAKE) -+ poll->events |= EPOLLONESHOT; - -+ if (io_poll_get_ownership(req)) - __io_poll_execute(req, mask); -- } - return 1; - } - --- -2.53.0 - diff --git a/queue-5.10/revert-io_uring-poll-fix-backport-of-io_poll_add-cha.patch b/queue-5.10/revert-io_uring-poll-fix-backport-of-io_poll_add-cha.patch deleted file mode 100644 index c127662bba..0000000000 --- a/queue-5.10/revert-io_uring-poll-fix-backport-of-io_poll_add-cha.patch +++ /dev/null @@ -1,43 +0,0 @@ -From dc40b77c2bb2dc092136b2d7443df6c352cdb845 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sat, 2 May 2026 20:32:43 -0400 -Subject: Revert "io_uring/poll: fix backport of io_poll_add() changes" - -This reverts commit 3edc04cc05f37faf1f0f1f77ca33fb616e8f6306. - -Signed-off-by: Sasha Levin ---- - io_uring/io_uring.c | 12 ++++++++---- - 1 file changed, 8 insertions(+), 4 deletions(-) - -diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c -index 8b0dfea96ee09..83806b3c6e3bc 100644 ---- a/io_uring/io_uring.c -+++ b/io_uring/io_uring.c -@@ -5991,15 +5991,19 @@ static int __io_poll_add(struct io_kiocb *req, unsigned int issue_flags) - if (!ret && ipt.error) - req_set_fail(req); - ret = ret ?: ipt.error; -- if (ret) -+ if (ret > 0) { - __io_req_complete(req, issue_flags, ret, 0); -- return ret; -+ return ret; -+ } -+ return 0; - } - - static int io_poll_add(struct io_kiocb *req, unsigned int issue_flags) - { -- __io_poll_add(req, issue_flags); -- return 0; -+ int ret; -+ -+ ret = __io_poll_add(req, issue_flags); -+ return ret < 0 ? ret : 0; - } - - static int io_poll_update(struct io_kiocb *req, unsigned int issue_flags) --- -2.53.0 - diff --git a/queue-5.10/revert-io_uring-poll-fix-epoll_uring_wake-sometimes-.patch b/queue-5.10/revert-io_uring-poll-fix-epoll_uring_wake-sometimes-.patch deleted file mode 100644 index 16d402ccfa..0000000000 --- a/queue-5.10/revert-io_uring-poll-fix-epoll_uring_wake-sometimes-.patch +++ /dev/null @@ -1,46 +0,0 @@ -From 3d639af7101238d66e215369d7ddd6701d27d115 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sat, 2 May 2026 20:32:43 -0400 -Subject: Revert "io_uring/poll: fix EPOLL_URING_WAKE sometimes not being - masked in" - -This reverts commit cc89e4186443c894e390e4db39a117bba23f17e8. - -Signed-off-by: Sasha Levin ---- - io_uring/io_uring.c | 17 +++++++++-------- - 1 file changed, 9 insertions(+), 8 deletions(-) - -diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c -index 83806b3c6e3bc..dea1fb22c0efb 100644 ---- a/io_uring/io_uring.c -+++ b/io_uring/io_uring.c -@@ -5647,16 +5647,17 @@ static int io_poll_wake(struct wait_queue_entry *wait, unsigned mode, int sync, - if (mask && !(mask & poll->events)) - return 0; - -- /* -- * If we trigger a multishot poll off our own wakeup path, -- * disable multishot as there is a circular dependency between -- * CQ posting and triggering the event. -- */ -- if (mask & EPOLL_URING_WAKE) -- poll->events |= EPOLLONESHOT; -+ if (io_poll_get_ownership(req)) { -+ /* -+ * If we trigger a multishot poll off our own wakeup path, -+ * disable multishot as there is a circular dependency between -+ * CQ posting and triggering the event. -+ */ -+ if (mask & EPOLL_URING_WAKE) -+ poll->events |= EPOLLONESHOT; - -- if (io_poll_get_ownership(req)) - __io_poll_execute(req, mask); -+ } - return 1; - } - --- -2.53.0 - diff --git a/queue-5.10/series b/queue-5.10/series index 8940fc2fd2..545f221c56 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -142,8 +142,6 @@ misc-ibmasm-fix-oob-mmio-read-in-ibmasm_handle_mouse_interrupt.patch ibmasm-fix-oob-reads-in-command_file_write-due-to-missing-size-checks.patch ibmasm-fix-heap-over-read-in-ibmasm_send_i2o_message.patch firmware-google-framebuffer-do-not-mark-framebuffer-as-busy.patch -io_uring-poll-fix-epoll_uring_wake-sometimes-not-bei.patch -io_uring-poll-fix-backport-of-io_poll_add-changes.patch revert-riscv-sparse-memory-vmemmap-out-of-bounds-fix.patch ocfs2-split-transactions-in-dio-completion-to-avoid-credit-exhaustion.patch padata-fix-pd-uaf-once-and-for-all.patch @@ -180,8 +178,6 @@ kvm-nsvm-sync-nextrip-to-cached-vmcb12-after-vmrun-of-l2.patch kvm-nsvm-sync-interrupt-shadow-to-cached-vmcb12-after-vmrun-of-l2.patch kvm-nsvm-ensure-avic-is-inhibited-when-restoring-a-vcpu-to-guest-mode.patch kvm-nsvm-clear-gif-on-nested-vmexit-invalid.patch -revert-io_uring-poll-fix-backport-of-io_poll_add-cha.patch -revert-io_uring-poll-fix-epoll_uring_wake-sometimes-.patch io_uring-poll-fix-epoll_uring_wake-sometimes-not-bei.patch-12437 io_uring-poll-fix-backport-of-io_poll_add-changes.patch-11453 mtd-docg3-fix-use-after-free-in-docg3_release.patch diff --git a/queue-5.15/io_uring-poll-fix-backport-of-io_poll_add-changes.patch b/queue-5.15/io_uring-poll-fix-backport-of-io_poll_add-changes.patch deleted file mode 100644 index 6409a7a9a2..0000000000 --- a/queue-5.15/io_uring-poll-fix-backport-of-io_poll_add-changes.patch +++ /dev/null @@ -1,45 +0,0 @@ -From 7a61c38c4d6ae3d5cbe6efa06885b1ca821a129c Mon Sep 17 00:00:00 2001 -From: Jens Axboe -Date: Tue, 21 Apr 2026 16:44:06 -0600 -Subject: io_uring/poll: fix backport of io_poll_add() changes - -From: Jens Axboe - -The 5.15/5.10 backport of 84230ad2d2af had a few issues, due to the -older poll base. Notably return value handling __io_arm_poll_handler() -and in return __io_poll_add() as well. Fix them up. - -Reported-by: Ben Hutchings -Fixes: 349ef5d2e7bf ("io_uring/poll: correctly handle io_poll_add() return value on update") -Signed-off-by: Jens Axboe -Signed-off-by: Greg Kroah-Hartman ---- - io_uring/io_uring.c | 12 ++++-------- - 1 file changed, 4 insertions(+), 8 deletions(-) - ---- a/io_uring/io_uring.c -+++ b/io_uring/io_uring.c -@@ -6138,19 +6138,15 @@ static int __io_poll_add(struct io_kiocb - if (!ret && ipt.error) - req_set_fail(req); - ret = ret ?: ipt.error; -- if (ret > 0) { -+ if (ret) - __io_req_complete(req, issue_flags, ret, 0); -- return ret; -- } -- return 0; -+ return ret; - } - - static int io_poll_add(struct io_kiocb *req, unsigned int issue_flags) - { -- int ret; -- -- ret = __io_poll_add(req, issue_flags); -- return ret < 0 ? ret : 0; -+ __io_poll_add(req, issue_flags); -+ return 0; - } - - static int io_poll_update(struct io_kiocb *req, unsigned int issue_flags) diff --git a/queue-5.15/io_uring-poll-fix-epoll_uring_wake-sometimes-not-being-masked-in.patch b/queue-5.15/io_uring-poll-fix-epoll_uring_wake-sometimes-not-being-masked-in.patch deleted file mode 100644 index 8896fb49aa..0000000000 --- a/queue-5.15/io_uring-poll-fix-epoll_uring_wake-sometimes-not-being-masked-in.patch +++ /dev/null @@ -1,45 +0,0 @@ -From 7fdfffce508f38d89338e8bbed421dd91ddfcb3f Mon Sep 17 00:00:00 2001 -From: Jens Axboe -Date: Tue, 21 Apr 2026 16:41:32 -0600 -Subject: io_uring/poll: fix EPOLL_URING_WAKE sometimes not being masked in - -From: Jens Axboe - -Rather than do it only when we jump straight to execution, mark it -regardless. This ensures it doesn't get lost. - -Fixes: ccf06b5a981c ("io_uring: pass in EPOLL_URING_WAKE for eventfd signaling and wakeups") -Signed-off-by: Jens Axboe -Signed-off-by: Greg Kroah-Hartman ---- - io_uring/io_uring.c | 17 ++++++++--------- - 1 file changed, 8 insertions(+), 9 deletions(-) - ---- a/io_uring/io_uring.c -+++ b/io_uring/io_uring.c -@@ -5794,17 +5794,16 @@ static int io_poll_wake(struct wait_queu - if (mask && !(mask & poll->events)) - return 0; - -- if (io_poll_get_ownership(req)) { -- /* -- * If we trigger a multishot poll off our own wakeup path, -- * disable multishot as there is a circular dependency between -- * CQ posting and triggering the event. -- */ -- if (mask & EPOLL_URING_WAKE) -- poll->events |= EPOLLONESHOT; -+ /* -+ * If we trigger a multishot poll off our own wakeup path, -+ * disable multishot as there is a circular dependency between -+ * CQ posting and triggering the event. -+ */ -+ if (mask & EPOLL_URING_WAKE) -+ poll->events |= EPOLLONESHOT; - -+ if (io_poll_get_ownership(req)) - __io_poll_execute(req, mask); -- } - return 1; - } - diff --git a/queue-5.15/revert-io_uring-poll-fix-backport-of-io_poll_add-cha.patch b/queue-5.15/revert-io_uring-poll-fix-backport-of-io_poll_add-cha.patch deleted file mode 100644 index efbe03489d..0000000000 --- a/queue-5.15/revert-io_uring-poll-fix-backport-of-io_poll_add-cha.patch +++ /dev/null @@ -1,43 +0,0 @@ -From 3eb256e82f341cd1ffe335f87d6f95ca664d94b1 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sat, 2 May 2026 19:29:45 -0400 -Subject: Revert "io_uring/poll: fix backport of io_poll_add() changes" - -This reverts commit 66d59bd23bb8437e495becdfdcf1f503d32910c1. - -Signed-off-by: Sasha Levin ---- - io_uring/io_uring.c | 12 ++++++++---- - 1 file changed, 8 insertions(+), 4 deletions(-) - -diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c -index 07519e9a695c0..db5c9fbdec3b4 100644 ---- a/io_uring/io_uring.c -+++ b/io_uring/io_uring.c -@@ -6138,15 +6138,19 @@ static int __io_poll_add(struct io_kiocb *req, unsigned int issue_flags) - if (!ret && ipt.error) - req_set_fail(req); - ret = ret ?: ipt.error; -- if (ret) -+ if (ret > 0) { - __io_req_complete(req, issue_flags, ret, 0); -- return ret; -+ return ret; -+ } -+ return 0; - } - - static int io_poll_add(struct io_kiocb *req, unsigned int issue_flags) - { -- __io_poll_add(req, issue_flags); -- return 0; -+ int ret; -+ -+ ret = __io_poll_add(req, issue_flags); -+ return ret < 0 ? ret : 0; - } - - static int io_poll_update(struct io_kiocb *req, unsigned int issue_flags) --- -2.53.0 - diff --git a/queue-5.15/revert-io_uring-poll-fix-epoll_uring_wake-sometimes-.patch b/queue-5.15/revert-io_uring-poll-fix-epoll_uring_wake-sometimes-.patch deleted file mode 100644 index 62dc6102d7..0000000000 --- a/queue-5.15/revert-io_uring-poll-fix-epoll_uring_wake-sometimes-.patch +++ /dev/null @@ -1,46 +0,0 @@ -From 404c0e8bea17a8d458a492d5a982399570ec4db8 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sat, 2 May 2026 19:29:45 -0400 -Subject: Revert "io_uring/poll: fix EPOLL_URING_WAKE sometimes not being - masked in" - -This reverts commit ae388b6752cb4b82f7be8b2edb704cd9569923f0. - -Signed-off-by: Sasha Levin ---- - io_uring/io_uring.c | 17 +++++++++-------- - 1 file changed, 9 insertions(+), 8 deletions(-) - -diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c -index db5c9fbdec3b4..38decfc1a914a 100644 ---- a/io_uring/io_uring.c -+++ b/io_uring/io_uring.c -@@ -5794,16 +5794,17 @@ static int io_poll_wake(struct wait_queue_entry *wait, unsigned mode, int sync, - if (mask && !(mask & poll->events)) - return 0; - -- /* -- * If we trigger a multishot poll off our own wakeup path, -- * disable multishot as there is a circular dependency between -- * CQ posting and triggering the event. -- */ -- if (mask & EPOLL_URING_WAKE) -- poll->events |= EPOLLONESHOT; -+ if (io_poll_get_ownership(req)) { -+ /* -+ * If we trigger a multishot poll off our own wakeup path, -+ * disable multishot as there is a circular dependency between -+ * CQ posting and triggering the event. -+ */ -+ if (mask & EPOLL_URING_WAKE) -+ poll->events |= EPOLLONESHOT; - -- if (io_poll_get_ownership(req)) - __io_poll_execute(req, mask); -+ } - return 1; - } - --- -2.53.0 - diff --git a/queue-5.15/series b/queue-5.15/series index 69b66a7123..74375062a0 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -163,8 +163,6 @@ cpufreq-avoid-a-bad-reference-count-on-cpu-node.patch drivers-base-free-devm-resources-when-unregistering-a-device.patch revert-wifi-cfg80211-stop-nan-and-p2p-in-cfg80211_leave.patch scripts-dtc-remove-unused-dts_version-in-dtc-lexer.l.patch -io_uring-poll-fix-epoll_uring_wake-sometimes-not-being-masked-in.patch -io_uring-poll-fix-backport-of-io_poll_add-changes.patch ksmbd-unset-conn-binding-on-failed-binding-request.patch rxrpc-only-handle-response-during-service-challenge.patch rxrpc-fix-anonymous-key-handling.patch @@ -239,8 +237,6 @@ kvm-nsvm-ensure-avic-is-inhibited-when-restoring-a-vcpu-to-guest-mode.patch kvm-nsvm-always-inject-a-gp-if-mapping-vmcb12-fails-on-nested-vmrun.patch kvm-nsvm-clear-gif-on-nested-vmexit-invalid.patch kvm-nsvm-add-missing-consistency-check-for-ncr3-validity.patch -revert-io_uring-poll-fix-backport-of-io_poll_add-cha.patch -revert-io_uring-poll-fix-epoll_uring_wake-sometimes-.patch io_uring-poll-fix-epoll_uring_wake-sometimes-not-bei.patch io_uring-poll-fix-backport-of-io_poll_add-changes.patch-10615 mtd-docg3-convert-to-platform-remove-callback-return.patch