qiurui
/
linux-kernelorg-stable
mirror of https://kernel.googlesource.com/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
linux-kernelorg-stable/io_uring
History
Jens Axboe 98b6fa62c8 io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths 
Since the buffers are mapped from userspace, it is prudent to use
READ_ONCE() to read the value into a local variable, and use that for
any other actions taken. Having a stable read of the buffer length
avoids worrying about it changing after checking, or being read multiple
times.

Similarly, the buffer may well change in between it being picked and
being committed. Ensure the looping for incremental ring buffer commit
stops if it hits a zero sized buffer, as no further progress can be made
at that point.

Fixes: ae98dbf43d ("io_uring/kbuf: add support for incremental buffer consumption")
Link: https://lore.kernel.org/io-uring/tencent_000C02641F6250C856D0C26228DE29A3D30A@qq.com/
Reported-by: Qingyue Zhang <chunzhennn@qq.com>
Reported-by: Suoxing Zhang <aftern00n@qq.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
 		2025-08-28 05:48:34 -06:00
..
Kconfig io_uring: make zcrx depend on CONFIG_IO_URING 2025-03-31 07:07:44 -06:00
Makefile io_uring/mock: add basic infra for test mock files 2025-07-02 08:10:26 -06:00
advise.c io_uring: finish IOU_OK -> IOU_COMPLETE transition 2025-05-21 08:41:16 -06:00
advise.h
…
alloc_cache.c io_uring: add alloc_cache.c 2025-01-28 15:10:40 -07:00
alloc_cache.h io_uring/net: convert to struct iou_vec 2025-03-07 13:41:08 -07:00
cancel.c io_uring: finish IOU_OK -> IOU_COMPLETE transition 2025-05-21 08:41:16 -06:00
cancel.h io_uring/cancel: add generic cancel helper 2025-02-17 05:34:45 -07:00
cmd_net.c io_uring/netcmd: add tx timestamping cmd support 2025-06-23 09:00:12 -06:00
epoll.c io_uring: finish IOU_OK -> IOU_COMPLETE transition 2025-05-21 08:41:16 -06:00
epoll.h io_uring/epoll: add support for IORING_OP_EPOLL_WAIT 2025-02-20 07:59:56 -07:00
eventfd.c io_uring/eventfd: open code io_eventfd_grab() 2025-04-24 08:33:54 -06:00
eventfd.h io_uring/eventfd: dedup signalling helpers 2025-04-24 08:33:54 -06:00
fdinfo.c io_uring: fix use-after-free of sq->thread in __io_uring_show_fdinfo() 2025-06-10 11:20:04 -06:00
fdinfo.h
…
filetable.c io_uring: cache nodes and mapped buffers 2025-02-28 07:05:46 -07:00
filetable.h io_uring/rsrc: pass 'struct io_ring_ctx' reference to rsrc helpers 2024-11-07 15:24:33 -07:00
fs.c io_uring: finish IOU_OK -> IOU_COMPLETE transition 2025-05-21 08:41:16 -06:00
fs.h
…
futex.c io_uring/futex: ensure io_futex_wait() cleans up properly on failure 2025-08-21 13:53:33 -06:00
futex.h io_uring: move cancelations to be io_uring_task based 2024-11-06 13:55:38 -07:00
io-wq.c io_uring/io-wq: add check free worker before create new worker 2025-08-13 06:31:10 -06:00
io-wq.h io_uring/wq: avoid indirect do_work/free_work calls 2025-04-21 05:06:58 -06:00
io_uring.c io_uring: clear ->async_data as part of normal init 2025-08-21 13:54:01 -06:00
io_uring.h io_uring: deduplicate wakeup handling 2025-07-15 12:20:06 -06:00
kbuf.c io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths 2025-08-28 05:48:34 -06:00
kbuf.h io_uring/kbuf: flag partial buffer mappings 2025-06-26 12:17:48 -06:00
memmap.c io_uring/memmap: cast nr_pages to size_t before shifting 2025-08-08 06:35:14 -06:00
memmap.h io_uring: update parameter name in io_pin_pages function declaration 2025-05-09 07:58:22 -06:00
mock_file.c io_uring/mock: add trivial poll handler 2025-07-02 08:10:26 -06:00
msg_ring.c io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU 2025-07-08 11:08:31 -06:00
msg_ring.h io_uring/msg_ring: Drop custom destructor 2024-12-27 10:08:21 -07:00
napi.c net: use napi_id_valid helper 2025-02-17 16:43:04 -08:00
napi.h io_uring/napi: add static napi tracking strategy 2024-11-06 13:55:38 -07:00
net.c io_uring/net: commit partial buffers on retry 2025-08-12 13:41:26 -06:00
net.h io_uring/net: convert to struct iou_vec 2025-03-07 13:41:08 -07:00
nop.c io_uring/nop: add IORING_NOP_TW completion flag 2025-06-23 08:59:13 -06:00
nop.h
…
notif.c io_uring: remove io_preinit_req() 2025-05-06 10:11:23 -06:00
notif.h
…
opdef.c Merge branch 'io_uring-6.16' into for-6.17/io_uring 2025-07-06 16:42:23 -06:00
opdef.h io_uring: add struct io_cold_def->sqe_copy() method 2025-06-23 08:59:13 -06:00
openclose.c fs/pipe: set FMODE_NOWAIT in create_pipe_files() 2025-06-10 13:16:19 +02:00
openclose.h io_uring: add support for IORING_OP_PIPE 2025-04-21 05:06:58 -06:00
poll.c for-6.17/io_uring-20250728 2025-07-28 16:30:12 -07:00
poll.h io_uring/poll: introduce io_arm_apoll() 2025-06-23 09:00:12 -06:00
refs.h io_uring: always do atomic put from iowq 2025-04-03 08:31:57 -06:00
register.c io_uring: consistently use rcu semantics with sqpoll thread 2025-06-12 08:17:09 -06:00
register.h io_uring: temporarily disable registered waits 2024-11-15 09:58:34 -07:00
rsrc.c io_uring: export io_[un]account_mem 2025-07-16 16:23:28 -06:00
rsrc.h io_uring: export io_[un]account_mem 2025-07-16 16:23:28 -06:00
rw.c io_uring/rw: cast rw->flags assignment to rwf_t 2025-07-07 16:46:30 -06:00
rw.h io_uring/kbuf: pass bgid to io_buffer_select() 2025-04-21 05:06:58 -06:00
slist.h
…
splice.c io_uring: finish IOU_OK -> IOU_COMPLETE transition 2025-05-21 08:41:16 -06:00
splice.h io_uring/splice: open code 2nd direct file assignment 2024-10-29 13:43:28 -06:00
sqpoll.c io_uring/sqpoll: don't put task_struct on tctx setup failure 2025-06-17 06:43:18 -06:00
sqpoll.h io_uring: consistently use rcu semantics with sqpoll thread 2025-06-12 08:17:09 -06:00
statx.c io_uring: finish IOU_OK -> IOU_COMPLETE transition 2025-05-21 08:41:16 -06:00
statx.h
…
sync.c io_uring: finish IOU_OK -> IOU_COMPLETE transition 2025-05-21 08:41:16 -06:00
sync.h
…
tctx.c io_uring/wq: avoid indirect do_work/free_work calls 2025-04-21 05:06:58 -06:00
tctx.h
…
timeout.c io_uring: finish IOU_OK -> IOU_COMPLETE transition 2025-05-21 08:41:16 -06:00
timeout.h io_uring/timeout: don't export link t-out disarm helper 2025-05-06 10:11:23 -06:00
truncate.c io_uring: finish IOU_OK -> IOU_COMPLETE transition 2025-05-21 08:41:16 -06:00
truncate.h
…
uring_cmd.c io_uring/cmd: remove struct io_uring_cmd_data 2025-07-18 12:34:56 -06:00
uring_cmd.h io_uring/cmd: remove struct io_uring_cmd_data 2025-07-18 12:34:56 -06:00
waitid.c io_uring: finish IOU_OK -> IOU_COMPLETE transition 2025-05-21 08:41:16 -06:00
waitid.h io_uring: move cancelations to be io_uring_task based 2024-11-06 13:55:38 -07:00
xattr.c io_uring: finish IOU_OK -> IOU_COMPLETE transition 2025-05-21 08:41:16 -06:00
xattr.h
…
zcrx.c for-6.17/io_uring-20250728 2025-07-28 16:30:12 -07:00
zcrx.h io_uring/zcrx: account area memory 2025-07-16 16:23:28 -06:00