Commit 3a12faba authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'io_uring-6.4-2023-06-15' of git://git.kernel.dk/linux 

Pull io_uring fixes from Jens Axboe:
 "A fix for sendmsg with CMSG, and the followup fix discussed for
  avoiding touching task->worker_private after the worker has started
  exiting"

* tag 'io_uring-6.4-2023-06-15' of git://git.kernel.dk/linux:
  io_uring/io-wq: clear current->worker_private on exit
  io_uring/net: save msghdr->msg_control for retries
parents b4af6821 adeaa3f2

io_uring/io-wq.c

+6 −1
Original line number Diff line number Diff line
@@ -220,7 +220,12 @@ static void io_worker_exit(struct io_worker *worker) 
	list_del_rcu(&worker->all_list);

	raw_spin_unlock(&wq->lock);

	io_wq_dec_running(worker);

	worker->flags = 0;

	/*

	 * this worker is a goner, clear ->worker_private to avoid any

	 * inc/dec running calls that could happen as part of exit from

	 * touching 'worker'.

	 */

	current->worker_private = NULL;



	kfree_rcu(worker, rcu);

	io_worker_ref_put(wq);

io_uring/net.c

+7 −1
Original line number Diff line number Diff line
@@ -65,6 +65,7 @@ struct io_sr_msg { 
	u16				addr_len;

	u16				buf_group;

	void __user			*addr;

	void __user			*msg_control;

	/* used only for send zerocopy */

	struct io_kiocb 		*notif;

};
@@ -195,11 +196,15 @@ static int io_sendmsg_copy_hdr(struct io_kiocb *req, 
			       struct io_async_msghdr *iomsg)

{

	struct io_sr_msg *sr = io_kiocb_to_cmd(req, struct io_sr_msg);

	int ret;



	iomsg->msg.msg_name = &iomsg->addr;

	iomsg->free_iov = iomsg->fast_iov;

	return sendmsg_copy_msghdr(&iomsg->msg, sr->umsg, sr->msg_flags,

	ret = sendmsg_copy_msghdr(&iomsg->msg, sr->umsg, sr->msg_flags,

					&iomsg->free_iov);

	/* save msg_control as sys_sendmsg() overwrites it */

	sr->msg_control = iomsg->msg.msg_control;

	return ret;

}



int io_send_prep_async(struct io_kiocb *req)
@@ -297,6 +302,7 @@ int io_sendmsg(struct io_kiocb *req, unsigned int issue_flags) 


	if (req_has_async_data(req)) {

		kmsg = req->async_data;

		kmsg->msg.msg_control = sr->msg_control;

	} else {

		ret = io_sendmsg_copy_hdr(req, &iomsg);

		if (ret)