This is a note to let you know that I've just added the patch titled io_uring/net: don't lose partial send_zc on fail to the 6.0-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: io_uring-net-don-t-lose-partial-send_zc-on-fail.patch and it can be found in the queue-6.0 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From foo@baz Mon Oct 17 11:35:32 AM CEST 2022 From: Pavel Begunkov <asml.silence@xxxxxxxxx> Date: Sun, 16 Oct 2022 21:33:27 +0100 Subject: io_uring/net: don't lose partial send_zc on fail To: stable@xxxxxxxxxxxxxxx Cc: Jens Axboe <axboe@xxxxxxxxx>, asml.silence@xxxxxxxxx Message-ID: <3493fc0ee75f3cf8a111e2e8e1a35f833f29aaf2.1665951939.git.asml.silence@xxxxxxxxx> From: Pavel Begunkov <asml.silence@xxxxxxxxx> [ upstream commit 5693bcce892d7b8b15a7a92b011d3d40a023b53c ] Partial zc send may end up in io_req_complete_failed(), which not only would return invalid result but also mask out the notification leading to lifetime issues. Cc: stable@xxxxxxxxxxxxxxx Signed-off-by: Pavel Begunkov <asml.silence@xxxxxxxxx> Link: https://lore.kernel.org/r/5673285b5e83e6ceca323727b4ddaa584b5cc91e.1663668091.git.asml.silence@xxxxxxxxx Signed-off-by: Jens Axboe <axboe@xxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- io_uring/net.c | 16 ++++++++++++++++ io_uring/net.h | 1 + io_uring/opdef.c | 1 + 3 files changed, 18 insertions(+) --- a/io_uring/net.c +++ b/io_uring/net.c @@ -1093,6 +1093,22 @@ void io_sendrecv_fail(struct io_kiocb *r io_req_set_res(req, res, req->cqe.flags); } +void io_send_zc_fail(struct io_kiocb *req) +{ + struct io_sr_msg *sr = io_kiocb_to_cmd(req, struct io_sr_msg); + int res = req->cqe.res; + + if (req->flags & REQ_F_PARTIAL_IO) { + if (req->flags & REQ_F_NEED_CLEANUP) { + io_notif_flush(sr->notif); + sr->notif = NULL; + req->flags &= ~REQ_F_NEED_CLEANUP; + } + res = sr->done_io; + } + io_req_set_res(req, res, req->cqe.flags); +} + int io_accept_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) { struct io_accept *accept = io_kiocb_to_cmd(req, struct io_accept); --- a/io_uring/net.h +++ b/io_uring/net.h @@ -58,6 +58,7 @@ int io_connect(struct io_kiocb *req, uns int io_sendzc(struct io_kiocb *req, unsigned int issue_flags); int io_sendzc_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe); void io_sendzc_cleanup(struct io_kiocb *req); +void io_send_zc_fail(struct io_kiocb *req); void io_netmsg_cache_free(struct io_cache_entry *entry); #else --- a/io_uring/opdef.c +++ b/io_uring/opdef.c @@ -494,6 +494,7 @@ const struct io_op_def io_op_defs[] = { .issue = io_sendzc, .prep_async = io_sendzc_prep_async, .cleanup = io_sendzc_cleanup, + .fail = io_send_zc_fail, #else .prep = io_eopnotsupp_prep, #endif Patches currently in stable-queue which might be from asml.silence@xxxxxxxxx are queue-6.0/io_uring-correct-pinned_vm-accounting.patch queue-6.0/io_uring-net-fix-notif-cqe-reordering.patch queue-6.0/io_uring-net-don-t-update-msg_name-if-not-provided.patch queue-6.0/io_uring-rw-fix-unexpected-link-breakage.patch queue-6.0/io_uring-net-don-t-skip-notifs-for-failed-requests.patch queue-6.0/io_uring-net-rename-io_sendzc.patch queue-6.0/io_uring-net-refactor-io_sr_msg-types.patch queue-6.0/io_uring-fix-cqe-reordering.patch queue-6.0/io_uring-net-don-t-lose-partial-send-recv-on-fail.patch queue-6.0/io_uring-rw-don-t-lose-partial-io-result-on-fail.patch queue-6.0/io_uring-net-fix-fast_iov-assignment-in-io_setup_async_msg.patch queue-6.0/io_uring-net-don-t-lose-partial-send_zc-on-fail.patch queue-6.0/io_uring-limit-registration-w-single_issuer.patch queue-6.0/io_uring-net-use-io_sr_msg-for-sendzc.patch queue-6.0/io_uring-add-custom-opcode-hooks-on-fail.patch queue-6.0/io_uring-rw-don-t-lose-short-results-on-io_setup_async_rw.patch queue-6.0/io_uring-af_unix-defer-registered-files-gc-to-io_uring-release.patch