From nobody Thu Dec 18 08:10:14 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 196E3C3A59D for ; Sat, 22 Oct 2022 07:34:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230148AbiJVHeq (ORCPT ); Sat, 22 Oct 2022 03:34:46 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48216 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230161AbiJVHe2 (ORCPT ); Sat, 22 Oct 2022 03:34:28 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 78F2D295B2B; Sat, 22 Oct 2022 00:34:17 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 1B16260AD9; Sat, 22 Oct 2022 07:34:16 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id F4095C433D6; Sat, 22 Oct 2022 07:34:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1666424055; bh=wgeTeUmxqjOE8P3QiWfW7xlfoUAGvL/ZupeOKUqspo8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=C3RnepN6sw1bDkiHCCTA1aP+3vDdK7AVzYo4Qca6ldBBIPLuIvF5+bkqP5A+KkCKk k5FRgH7Ai+nLF+95+jh6LwEWG5LAnKrHFigib2oAjsp+D2EjAHzWDKL/OCWke6COJg ukT+t60GNs/l57Hl26LmflwOE8TJBf5U4WVhF9Ho= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Pavel Begunkov , Thadeu Lima de Souza Cascardo , Jens Axboe , David Bouman Subject: [PATCH 5.19 014/717] io_uring/af_unix: defer registered files gc to io_uring release Date: Sat, 22 Oct 2022 09:18:13 +0200 Message-Id: <20221022072417.584975027@linuxfoundation.org> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221022072415.034382448@linuxfoundation.org> References: <20221022072415.034382448@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Pavel Begunkov commit 0091bfc81741b8d3aeb3b7ab8636f911b2de6e80 upstream. Instead of putting io_uring's registered files in unix_gc() we want it to be done by io_uring itself. The trick here is to consider io_uring registered files for cycle detection but not actually putting them down. Because io_uring can't register other ring instances, this will remove all refs to the ring file triggering the ->release path and clean up with io_ring_ctx_free(). Cc: stable@vger.kernel.org Fixes: 6b06314c47e1 ("io_uring: add file set registration") Reported-and-tested-by: David Bouman Signed-off-by: Pavel Begunkov Signed-off-by: Thadeu Lima de Souza Cascardo [axboe: add kerneldoc comment to skb, fold in skb leak fix] Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman --- include/linux/skbuff.h | 2 ++ io_uring/io_uring.c | 1 + net/unix/garbage.c | 20 ++++++++++++++++++++ 3 files changed, 23 insertions(+) --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@ -965,6 +965,7 @@ typedef unsigned char *sk_buff_data_t; * @csum_level: indicates the number of consecutive checksums found in * the packet minus one that have been verified as * CHECKSUM_UNNECESSARY (max 3) + * @scm_io_uring: SKB holds io_uring registered files * @dst_pending_confirm: need to confirm neighbour * @decrypted: Decrypted SKB * @slow_gro: state present at GRO time, slower prepare step required @@ -1144,6 +1145,7 @@ struct sk_buff { #endif __u8 slow_gro:1; __u8 csum_not_inet:1; + __u8 scm_io_uring:1; =20 #ifdef CONFIG_NET_SCHED __u16 tc_index; /* traffic control index */ --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -9484,6 +9484,7 @@ static int io_scm_file_account(struct io =20 UNIXCB(skb).fp =3D fpl; skb->sk =3D sk; + skb->scm_io_uring =3D 1; skb->destructor =3D unix_destruct_scm; refcount_add(skb->truesize, &sk->sk_wmem_alloc); } --- a/net/unix/garbage.c +++ b/net/unix/garbage.c @@ -204,6 +204,7 @@ void wait_for_unix_gc(void) /* The external entry point: unix_gc() */ void unix_gc(void) { + struct sk_buff *next_skb, *skb; struct unix_sock *u; struct unix_sock *next; struct sk_buff_head hitlist; @@ -297,11 +298,30 @@ void unix_gc(void) =20 spin_unlock(&unix_gc_lock); =20 + /* We need io_uring to clean its registered files, ignore all io_uring + * originated skbs. It's fine as io_uring doesn't keep references to + * other io_uring instances and so killing all other files in the cycle + * will put all io_uring references forcing it to go through normal + * release.path eventually putting registered files. + */ + skb_queue_walk_safe(&hitlist, skb, next_skb) { + if (skb->scm_io_uring) { + __skb_unlink(skb, &hitlist); + skb_queue_tail(&skb->sk->sk_receive_queue, skb); + } + } + /* Here we are. Hitlist is filled. Die. */ __skb_queue_purge(&hitlist); =20 spin_lock(&unix_gc_lock); =20 + /* There could be io_uring registered files, just push them back to + * the inflight list + */ + list_for_each_entry_safe(u, next, &gc_candidates, link) + list_move_tail(&u->link, &gc_inflight_list); + /* All candidates should have been detached by now. */ BUG_ON(!list_empty(&gc_candidates));