On 9/24/24 3:40 PM, Al Viro wrote: > On Mon, Sep 23, 2024 at 09:36:59PM +0100, Al Viro wrote: > >> * go through the VFS side of things and make sure we have a consistent >> set of helpers that would take struct filename * - *not* the ad-hoc mix we >> have right now, when that's basically driven by io_uring borging them in >> one by one - or duplicates them without bothering to share helpers. >> E.g. mkdirat(2) does getname() and passes it to do_mkdirat(), which >> consumes the sucker; so does mknodat(2), but do_mknodat() is static. OTOH, >> path_setxattr() does setxattr_copy(), then retry_estale loop with >> user_path_at() + mnt_want_write() + do_setxattr() + mnt_drop_write() + path_put() >> as a body, while on io_uring side we have retry_estale loop with filename_lookup() + >> (io_uring helper that does mnt_want_write() + do_setxattr() + mnt_drop_write()) + >> path_put(). >> Sure, that user_path_at() call is getname() + filename_lookup() + putname(), >> so they are equivalent, but keeping that shite in sync is going to be trouble. > > BTW, re mess around xattr: > static int __io_getxattr_prep(struct io_kiocb *req, > const struct io_uring_sqe *sqe) > { > ... > ix->ctx.cvalue = u64_to_user_ptr(READ_ONCE(sqe->addr2)); > ix->ctx.size = READ_ONCE(sqe->len); > ... > ret = strncpy_from_user(ix->ctx.kname->name, name, > sizeof(ix->ctx.kname->name)); > > } > > int io_fgetxattr(struct io_kiocb *req, unsigned int issue_flags) > { > ... > ret = do_getxattr(file_mnt_idmap(req->file), > req->file->f_path.dentry, > &ix->ctx); > ... > } > > ssize_t > do_getxattr(struct mnt_idmap *idmap, struct dentry *d, > struct xattr_ctx *ctx) > { > ... > if (error > 0) { > if (ctx->size && copy_to_user(ctx->value, ctx->kvalue, error)) > ... > } > > and we have > struct xattr_ctx { > /* Value of attribute */ > union { > const void __user *cvalue; > void __user *value; > }; > ... > } > > Undefined behaviour aside, there's something odd going on here: > why do we bother with copy-in in ->prep() when we do copy-out in > ->issue() anyway? ->issue() does run with initiator's ->mm in use, > right? > > IOW, what's the io_uring policy on what gets copied in ->prep() vs. > in ->issue()? The normal policy is that anything that is read-only should remain stable after ->prep() has been called, so that ->issue() can use it. That means the application can keep it on-stack as long as it's valid until io_uring_submit() returns. For structs/buffers that are copied to after IO, those the application obviously need to keep around until they see a completion for that request. So yes, for the xattr cases where the struct is copied to at completion time, those do not need to be stable after ->prep(), could be handled purely on the ->issue() side. -- Jens Axboe