This is a note to let you know that I've just added the patch titled io_uring: round-up cq size before comparing with rounded sq size to the 5.9-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: io_uring-round-up-cq-size-before-comparing-with-rounded-sq-size.patch and it can be found in the queue-5.9 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 88ec3211e46344a7d10cf6cb5045f839f7785f8e Mon Sep 17 00:00:00 2001 From: Jens Axboe <axboe@xxxxxxxxx> Date: Wed, 11 Nov 2020 10:38:53 -0700 Subject: io_uring: round-up cq size before comparing with rounded sq size From: Jens Axboe <axboe@xxxxxxxxx> commit 88ec3211e46344a7d10cf6cb5045f839f7785f8e upstream. If an application specifies IORING_SETUP_CQSIZE to set the CQ ring size to a specific size, we ensure that the CQ size is at least that of the SQ ring size. But in doing so, we compare the already rounded up to power of two SQ size to the as-of yet unrounded CQ size. This means that if an application passes in non power of two sizes, we can return -EINVAL when the final value would've been fine. As an example, an application passing in 100/100 for sq/cq size should end up with 128 for both. But since we round the SQ size first, we compare the CQ size of 100 to 128, and return -EINVAL as that is too small. Cc: stable@xxxxxxxxxxxxxxx Fixes: 33a107f0a1b8 ("io_uring: allow application controlled CQ ring size") Reported-by: Dan Melnic <dmm@xxxxxx> Signed-off-by: Jens Axboe <axboe@xxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- fs/io_uring.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -8878,6 +8878,7 @@ static int io_uring_create(unsigned entr * to a power-of-two, if it isn't already. We do NOT impose * any cq vs sq ring sizing. */ + p->cq_entries = roundup_pow_of_two(p->cq_entries); if (p->cq_entries < p->sq_entries) return -EINVAL; if (p->cq_entries > IORING_MAX_CQ_ENTRIES) { @@ -8885,7 +8886,6 @@ static int io_uring_create(unsigned entr return -EINVAL; p->cq_entries = IORING_MAX_CQ_ENTRIES; } - p->cq_entries = roundup_pow_of_two(p->cq_entries); } else { p->cq_entries = 2 * p->sq_entries; } Patches currently in stable-queue which might be from axboe@xxxxxxxxx are queue-5.9/block-add-a-return-value-to-set_capacity_revalidate_and_notify.patch queue-5.9/loop-fix-occasional-uevent-drop.patch queue-5.9/io_uring-round-up-cq-size-before-comparing-with-rounded-sq-size.patch queue-5.9/io_uring-ensure-consistent-view-of-original-task-mm-.patch queue-5.9/nbd-don-t-update-block-size-after-device-is-started.patch queue-5.9/nbd-fix-a-block_device-refcount-leak-in-nbd_release.patch