mirror of
https://github.com/torvalds/linux.git
synced 2026-11-06 21:58:01 +01:00
9ed11143be
-----BEGIN PGP SIGNATURE-----
iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmrknLkQHGF4Ym9lQGtl
cm5lbC5kawAKCRD301j7KXHgpkHqD/9UX2LGi+78JGR8myWEsKaJxulcHSKRui2J
CmdLFuVp6Hvpy8lXgOOOq1n2jPktV5mH8QzaSPVLiHW4f3VC6I5NuLX5apycKtu7
Fu9RLwPcH+S+UV8FjMq4ZRbSXyEPM1+9/TguiUDNP9myL9bL1ixkgh/SLCMU4wHF
LYWSv2BHdvxue1Qg6ALX4JDfQDhKLC4k/0Re1XNaTOJQiDjcioluE/nZqMy/YLZt
i1e+XiCOVDeoHpO7tsiGYIAaEQGAVWK0VL+lGr8Hg4/uCKtmd/VjiilZp73OopXF
XfCxZN5qMG1l9ZEm7hCUc8ZlF1Yhjjw2hZCVbIWU9jrchUMM2M7urSbDNrobIM1+
kjN0CZtOYEPiL7U1VN5qbtfdwy3CwzW6DLoMD6AH89fkPg1U8JaoGDp0inabM2aS
QFdmgVTMz5tUmN5f2E5WiwXwU5hZN6zscLVqaNx3UBKqhPY+aQoWWtyDL9jAFpay
doo4r4DjPJEHW+Qxd9eAKbNf123PnKlDL8Ej8PMjQo93HotWQT67HAObt1WS+Dri
p7rV9YWGXOLIbk9MBElyWob8qY8XIP4z2RrtgwriL9pGk5EN2LukRLfhbW7fw9fM
xrfrPiKywWqxbsycmYJdlprSmHXengoDdJBSavpqaebiPNW45eaRxYWzM2pgfioO
NNiG2nUpJA==
=GdWz
-----END PGP SIGNATURE-----
Merge tag 'io_uring-7.4-20261029' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull io_uring fixes from Jens Axboe:
- A batch of fixes from Chris:
- Charge registered buffer arrays, rsrc nodes, tctx nodes and
personalities to memcg, and free the XArray nodes a failed store
leaves behind.
- Clear bpf_ctx while submitting SQEs from a bpf-ops program, as the
socket code otherwise skips both the capability check and
lock_sock() for a setsockopt from the SQ.
- Free the task context after an RCU grace period, closing a UAF
when a foreign task frees the last request.
- Stop io_ring_exit_work() from waiting on an SQPOLL thread held in
get_signal(), and drop sqd->lock while the thread waits for
in-flight requests, as either one could pin every iou_exit slot
- io-wq fixes:
- Don't create new workers once the exit has begun, which could
leave an exiting worker in the thread group under exec
- save the worker type before dropping its reference (KASAN UAF)
- Defer io-wq enqueues from a foreign task to task_work, as an
IOPOLL reap by another task could race io_wq_put_and_exit()
- Keep the drain active when the deferred request being started is
itself a drain request, and don't attach a new ring to an SQPOLL
thread that is already canceling
- Fix the multishot recv length limit accounting, and count cancelled
timeouts in cq_timeouts so an armed off timeout doesn't fire early
- Advance the buffer ring head when a pickup empties it, and keep the
recvmsg buffer select length within MAX_RW_COUNT
- Mask the socket type in the bpf filter population so SOCK_CLOEXEC or
SOCK_NONBLOCK can't bypass a type filter, and enforce the per-task
register restrictions for blind registration
- Complete a non-blocking connect() that fails with -EAGAIN rather than
retrying it through poll and io-wq, matching connect(2)
- napi list traversal cleanup, and remove a useless min_not_zero()
* tag 'io_uring-7.4-20261029' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (21 commits)
io_uring/sqpoll: don't attach to a thread that is canceling
io_uring/net: fix multishot recv length limit accounting
io_uring/timeout: count cancelled timeouts in cq_timeouts
io_uring/napi: clean up list traversal with list_for_each_entry_safe()
io_uring: defer foreign io-wq enqueues to task_work
io_uring/io-wq: save worker type before dropping its reference
io_uring/cancel: drop sqd->lock while SQPOLL waits
io_uring/sqpoll: don't wait for the thread to exit
io_uring: free the task context after a grace period
io_uring/bpf-ops: clear bpf_ctx while submitting SQEs
io_uring: free XArray nodes left by a failed store
io_uring: charge tctx nodes and personalities
io_uring/rsrc: charge buffer arrays and nodes to memcg
io_uring/io-wq: no new workers once the exit has begun
io_uring: keep the drain active when a deferred drain request is started
io_uring/net: don't retry a non-blocking connect() that fails with -EAGAIN
io_uring/register: enforce per-task restrictions in io_uring_register_blind()
io_uring/net: mask socket type with SOCK_TYPE_MASK in io_socket_bpf_populate()
io_uring/net: Remove useless min_not_zero() usage
io_uring/net: keep recvmsg buffer select length within MAX_RW_COUNT
...
|
||
|---|---|---|
| .. | ||
| advise.c | ||
| advise.h | ||
| alloc_cache.c | ||
| alloc_cache.h | ||
| bpf_filter.c | ||
| bpf_filter.h | ||
| bpf-ops.c | ||
| bpf-ops.h | ||
| cancel.c | ||
| cancel.h | ||
| cmd_net.c | ||
| dma-buf.c | ||
| dma-buf.h | ||
| epoll.c | ||
| epoll.h | ||
| eventfd.c | ||
| eventfd.h | ||
| fdinfo.c | ||
| fdinfo.h | ||
| filetable.c | ||
| filetable.h | ||
| fs.c | ||
| fs.h | ||
| futex.c | ||
| futex.h | ||
| io_uring.c | ||
| io_uring.h | ||
| io-wq.c | ||
| io-wq.h | ||
| kbuf.c | ||
| kbuf.h | ||
| Kconfig | ||
| loop.c | ||
| loop.h | ||
| Makefile | ||
| memmap.c | ||
| memmap.h | ||
| mock_file.c | ||
| mpscq.h | ||
| msg_ring.c | ||
| msg_ring.h | ||
| napi.c | ||
| napi.h | ||
| net.c | ||
| net.h | ||
| nop.c | ||
| nop.h | ||
| notif.c | ||
| notif.h | ||
| opdef.c | ||
| opdef.h | ||
| openclose.c | ||
| openclose.h | ||
| poll.c | ||
| poll.h | ||
| query.c | ||
| query.h | ||
| refs.h | ||
| register.c | ||
| register.h | ||
| rsrc.c | ||
| rsrc.h | ||
| rw.c | ||
| rw.h | ||
| slist.h | ||
| splice.c | ||
| splice.h | ||
| sqpoll.c | ||
| sqpoll.h | ||
| statx.c | ||
| statx.h | ||
| sync.c | ||
| sync.h | ||
| tctx.c | ||
| tctx.h | ||
| timeout.c | ||
| timeout.h | ||
| truncate.c | ||
| truncate.h | ||
| tw.c | ||
| tw.h | ||
| uring_cmd.c | ||
| uring_cmd.h | ||
| wait.c | ||
| wait.h | ||
| waitid.c | ||
| waitid.h | ||
| xattr.c | ||
| xattr.h | ||
| zcrx.c | ||
| zcrx.h | ||