1// SPDX-License-Identifier: GPL-2.0
2#include <linux/kernel.h>
3#include <linux/errno.h>
4#include <linux/file.h>
5#include <linux/mm.h>
6#include <linux/slab.h>
7#include <linux/nospec.h>
8#include <linux/io_uring.h>
9
10#include <uapi/linux/io_uring.h>
11
12#include "io_uring.h"
13#include "tctx.h"
14
15static struct io_wq *io_init_wq_offload(struct io_ring_ctx *ctx,
16 struct task_struct *task)
17{
18 struct io_wq_hash *hash;
19 struct io_wq_data data;
20 unsigned int concurrency;
21
22 mutex_lock(lock: &ctx->uring_lock);
23 hash = ctx->hash_map;
24 if (!hash) {
25 hash = kzalloc(sizeof(*hash), GFP_KERNEL);
26 if (!hash) {
27 mutex_unlock(lock: &ctx->uring_lock);
28 return ERR_PTR(error: -ENOMEM);
29 }
30 refcount_set(r: &hash->refs, n: 1);
31 init_waitqueue_head(&hash->wait);
32 ctx->hash_map = hash;
33 }
34 mutex_unlock(lock: &ctx->uring_lock);
35
36 data.hash = hash;
37 data.task = task;
38
39 /* Do QD, or 4 * CPUS, whatever is smallest */
40 concurrency = min(ctx->sq_entries, 4 * num_online_cpus());
41
42 return io_wq_create(bounded: concurrency, data: &data);
43}
44
45void __io_uring_free(struct task_struct *tsk)
46{
47 struct io_uring_task *tctx = tsk->io_uring;
48 struct io_tctx_node *node;
49 unsigned long index;
50
51 /*
52 * Fault injection forcing allocation errors in the xa_store() path
53 * can lead to xa_empty() returning false, even though no actual
54 * node is stored in the xarray. Until that gets sorted out, attempt
55 * an iteration here and warn if any entries are found.
56 */
57 xa_for_each(&tctx->xa, index, node) {
58 WARN_ON_ONCE(1);
59 break;
60 }
61 WARN_ON_ONCE(tctx->io_wq);
62 WARN_ON_ONCE(tctx->cached_refs);
63
64 percpu_counter_destroy(fbc: &tctx->inflight);
65 kfree(objp: tctx);
66 tsk->io_uring = NULL;
67}
68
69__cold int io_uring_alloc_task_context(struct task_struct *task,
70 struct io_ring_ctx *ctx)
71{
72 struct io_uring_task *tctx;
73 int ret;
74
75 tctx = kzalloc(sizeof(*tctx), GFP_KERNEL);
76 if (unlikely(!tctx))
77 return -ENOMEM;
78
79 ret = percpu_counter_init(&tctx->inflight, 0, GFP_KERNEL);
80 if (unlikely(ret)) {
81 kfree(objp: tctx);
82 return ret;
83 }
84
85 tctx->io_wq = io_init_wq_offload(ctx, task);
86 if (IS_ERR(ptr: tctx->io_wq)) {
87 ret = PTR_ERR(ptr: tctx->io_wq);
88 percpu_counter_destroy(fbc: &tctx->inflight);
89 kfree(objp: tctx);
90 return ret;
91 }
92
93 tctx->task = task;
94 xa_init(xa: &tctx->xa);
95 init_waitqueue_head(&tctx->wait);
96 atomic_set(v: &tctx->in_cancel, i: 0);
97 atomic_set(v: &tctx->inflight_tracked, i: 0);
98 task->io_uring = tctx;
99 init_llist_head(list: &tctx->task_list);
100 init_task_work(twork: &tctx->task_work, func: tctx_task_work);
101 return 0;
102}
103
104int __io_uring_add_tctx_node(struct io_ring_ctx *ctx)
105{
106 struct io_uring_task *tctx = current->io_uring;
107 struct io_tctx_node *node;
108 int ret;
109
110 if (unlikely(!tctx)) {
111 ret = io_uring_alloc_task_context(current, ctx);
112 if (unlikely(ret))
113 return ret;
114
115 tctx = current->io_uring;
116 if (ctx->iowq_limits_set) {
117 unsigned int limits[2] = { ctx->iowq_limits[0],
118 ctx->iowq_limits[1], };
119
120 ret = io_wq_max_workers(wq: tctx->io_wq, new_count: limits);
121 if (ret)
122 return ret;
123 }
124 }
125 if (!xa_load(&tctx->xa, index: (unsigned long)ctx)) {
126 node = kmalloc(sizeof(*node), GFP_KERNEL);
127 if (!node)
128 return -ENOMEM;
129 node->ctx = ctx;
130 node->task = current;
131
132 ret = xa_err(entry: xa_store(&tctx->xa, index: (unsigned long)ctx,
133 entry: node, GFP_KERNEL));
134 if (ret) {
135 kfree(objp: node);
136 return ret;
137 }
138
139 mutex_lock(lock: &ctx->uring_lock);
140 list_add(new: &node->ctx_node, head: &ctx->tctx_list);
141 mutex_unlock(lock: &ctx->uring_lock);
142 }
143 return 0;
144}
145
146int __io_uring_add_tctx_node_from_submit(struct io_ring_ctx *ctx)
147{
148 int ret;
149
150 if (ctx->flags & IORING_SETUP_SINGLE_ISSUER
151 && ctx->submitter_task != current)
152 return -EEXIST;
153
154 ret = __io_uring_add_tctx_node(ctx);
155 if (ret)
156 return ret;
157
158 current->io_uring->last = ctx;
159 return 0;
160}
161
162/*
163 * Remove this io_uring_file -> task mapping.
164 */
165__cold void io_uring_del_tctx_node(unsigned long index)
166{
167 struct io_uring_task *tctx = current->io_uring;
168 struct io_tctx_node *node;
169
170 if (!tctx)
171 return;
172 node = xa_erase(&tctx->xa, index);
173 if (!node)
174 return;
175
176 WARN_ON_ONCE(current != node->task);
177 WARN_ON_ONCE(list_empty(&node->ctx_node));
178
179 mutex_lock(lock: &node->ctx->uring_lock);
180 list_del(entry: &node->ctx_node);
181 mutex_unlock(lock: &node->ctx->uring_lock);
182
183 if (tctx->last == node->ctx)
184 tctx->last = NULL;
185 kfree(objp: node);
186}
187
188__cold void io_uring_clean_tctx(struct io_uring_task *tctx)
189{
190 struct io_wq *wq = tctx->io_wq;
191 struct io_tctx_node *node;
192 unsigned long index;
193
194 xa_for_each(&tctx->xa, index, node) {
195 io_uring_del_tctx_node(index);
196 cond_resched();
197 }
198 if (wq) {
199 /*
200 * Must be after io_uring_del_tctx_node() (removes nodes under
201 * uring_lock) to avoid race with io_uring_try_cancel_iowq().
202 */
203 io_wq_put_and_exit(wq);
204 tctx->io_wq = NULL;
205 }
206}
207
208void io_uring_unreg_ringfd(void)
209{
210 struct io_uring_task *tctx = current->io_uring;
211 int i;
212
213 for (i = 0; i < IO_RINGFD_REG_MAX; i++) {
214 if (tctx->registered_rings[i]) {
215 fput(tctx->registered_rings[i]);
216 tctx->registered_rings[i] = NULL;
217 }
218 }
219}
220
221int io_ring_add_registered_file(struct io_uring_task *tctx, struct file *file,
222 int start, int end)
223{
224 int offset;
225 for (offset = start; offset < end; offset++) {
226 offset = array_index_nospec(offset, IO_RINGFD_REG_MAX);
227 if (tctx->registered_rings[offset])
228 continue;
229
230 tctx->registered_rings[offset] = file;
231 return offset;
232 }
233 return -EBUSY;
234}
235
236static int io_ring_add_registered_fd(struct io_uring_task *tctx, int fd,
237 int start, int end)
238{
239 struct file *file;
240 int offset;
241
242 file = fget(fd);
243 if (!file) {
244 return -EBADF;
245 } else if (!io_is_uring_fops(file)) {
246 fput(file);
247 return -EOPNOTSUPP;
248 }
249 offset = io_ring_add_registered_file(tctx, file, start, end);
250 if (offset < 0)
251 fput(file);
252 return offset;
253}
254
255/*
256 * Register a ring fd to avoid fdget/fdput for each io_uring_enter()
257 * invocation. User passes in an array of struct io_uring_rsrc_update
258 * with ->data set to the ring_fd, and ->offset given for the desired
259 * index. If no index is desired, application may set ->offset == -1U
260 * and we'll find an available index. Returns number of entries
261 * successfully processed, or < 0 on error if none were processed.
262 */
263int io_ringfd_register(struct io_ring_ctx *ctx, void __user *__arg,
264 unsigned nr_args)
265{
266 struct io_uring_rsrc_update __user *arg = __arg;
267 struct io_uring_rsrc_update reg;
268 struct io_uring_task *tctx;
269 int ret, i;
270
271 if (!nr_args || nr_args > IO_RINGFD_REG_MAX)
272 return -EINVAL;
273
274 mutex_unlock(lock: &ctx->uring_lock);
275 ret = __io_uring_add_tctx_node(ctx);
276 mutex_lock(lock: &ctx->uring_lock);
277 if (ret)
278 return ret;
279
280 tctx = current->io_uring;
281 for (i = 0; i < nr_args; i++) {
282 int start, end;
283
284 if (copy_from_user(to: &reg, from: &arg[i], n: sizeof(reg))) {
285 ret = -EFAULT;
286 break;
287 }
288
289 if (reg.resv) {
290 ret = -EINVAL;
291 break;
292 }
293
294 if (reg.offset == -1U) {
295 start = 0;
296 end = IO_RINGFD_REG_MAX;
297 } else {
298 if (reg.offset >= IO_RINGFD_REG_MAX) {
299 ret = -EINVAL;
300 break;
301 }
302 start = reg.offset;
303 end = start + 1;
304 }
305
306 ret = io_ring_add_registered_fd(tctx, fd: reg.data, start, end);
307 if (ret < 0)
308 break;
309
310 reg.offset = ret;
311 if (copy_to_user(to: &arg[i], from: &reg, n: sizeof(reg))) {
312 fput(tctx->registered_rings[reg.offset]);
313 tctx->registered_rings[reg.offset] = NULL;
314 ret = -EFAULT;
315 break;
316 }
317 }
318
319 return i ? i : ret;
320}
321
322int io_ringfd_unregister(struct io_ring_ctx *ctx, void __user *__arg,
323 unsigned nr_args)
324{
325 struct io_uring_rsrc_update __user *arg = __arg;
326 struct io_uring_task *tctx = current->io_uring;
327 struct io_uring_rsrc_update reg;
328 int ret = 0, i;
329
330 if (!nr_args || nr_args > IO_RINGFD_REG_MAX)
331 return -EINVAL;
332 if (!tctx)
333 return 0;
334
335 for (i = 0; i < nr_args; i++) {
336 if (copy_from_user(to: &reg, from: &arg[i], n: sizeof(reg))) {
337 ret = -EFAULT;
338 break;
339 }
340 if (reg.resv || reg.data || reg.offset >= IO_RINGFD_REG_MAX) {
341 ret = -EINVAL;
342 break;
343 }
344
345 reg.offset = array_index_nospec(reg.offset, IO_RINGFD_REG_MAX);
346 if (tctx->registered_rings[reg.offset]) {
347 fput(tctx->registered_rings[reg.offset]);
348 tctx->registered_rings[reg.offset] = NULL;
349 }
350 }
351
352 return i ? i : ret;
353}
354