kernel/linux.git/io_uring/net.c, branch v7.1-rc5

io_uring/net: punt IORING_OP_BIND async if it needs file create

2026-05-15T17:02:16+00:00

For two reasons: 1) An opcode cannot block inside io_uring_enter() doing submissions, as it'll stall the submission side pipeline. 2) Ending up in sb_start_write() -> __sb_start_write() -> percpu_down_read_freezable() introduces a new lockdep edge, which it correctly complains about. Check if the socket type is AF_UNIX and has a non-empty pathname. If it does, mark it REQ_F_FORCE_ASYNC to punt the submission to io-wq rather than attempt to do it inline. Fixes: 7481fd93fa0a ("io_uring: Introduce IORING_OP_BIND") Reviewed-by: Gabriel Krisman Bertazi Signed-off-by: Jens Axboe

Merge tag 'for-7.1/io_uring-20260411' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

2026-04-13T23:22:30+00:00

Pull io_uring updates from Jens Axboe: - Add a callback driven main loop for io_uring, and BPF struct_ops on top to allow implementing custom event loop logic - Decouple IOPOLL from being a ring-wide all-or-nothing setting, allowing IOPOLL use cases to also issue certain white listed non-polled opcodes - Timeout improvements. Migrate internal timeout storage from timespec64 to ktime_t for simpler arithmetic and avoid copying of timespec data - Zero-copy receive (zcrx) updates: - Add a device-less mode (ZCRX_REG_NODEV) for testing and experimentation where data flows through the copy fallback path - Fix two-step unregistration regression, DMA length calculations, xarray mark usage, and a potential 32-bit overflow in id shifting - Refactoring toward multi-area support: dedicated refill queue struct, consolidated DMA syncing, netmem array refilling format, and guard-based locking - Zero-copy transmit (zctx) cleanup: - Unify io_send_zc() and io_sendmsg_zc() into a single function - Add vectorized registered buffer send for IORING_OP_SEND_ZC - Add separate notification user_data via sqe->addr3 so notification and completion CQEs can be distinguished without extra reference counting - Switch struct io_ring_ctx internal bitfields to explicit flag bits with atomic-safe accessors, and annotate the known harmless races on those flags - Various optimizations caching ctx and other request fields in local variables to avoid repeated loads, and cleanups for tctx setup, ring fd registration, and read path early returns * tag 'for-7.1/io_uring-20260411' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (58 commits) io_uring: unify getting ctx from passed in file descriptor io_uring/register: don't get a reference to the registered ring fd io_uring/tctx: clean up __io_uring_add_tctx_node() error handling io_uring/tctx: have io_uring_alloc_task_context() return tctx io_uring/timeout: use 'ctx' consistently io_uring/rw: clean up __io_read() obsolete comment and early returns io_uring/zcrx: use correct mmap off constants io_uring/zcrx: use dma_len for chunk size calculation io_uring/zcrx: don't clear not allocated niovs io_uring/zcrx: don't use mark0 for allocating xarray io_uring: cast id to u64 before shifting in io_allocate_rbuf_ring() io_uring/zcrx: reject REG_NODEV with large rx_buf_size io_uring/cancel: validate opcode for IORING_ASYNC_CANCEL_OP io_uring/rsrc: use io_cache_free() to free node io_uring/zcrx: rename zcrx [un]register functions io_uring/zcrx: check ctrl op payload struct sizes io_uring/zcrx: cache fallback availability in zcrx ctx io_uring/zcrx: warn on a repeated area append io_uring/zcrx: consolidate dma syncing io_uring/zcrx: netmem array as refiling format ...

io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs()

2026-03-29T20:03:14+00:00

sqe->len is __u32 but gets stored into sr->len which is int. When userspace passes sqe->len values exceeding INT_MAX (e.g. 0xFFFFFFFF), sr->len overflows to a negative value. This negative value propagates through the bundle recv/send path: 1. io_recv(): sel.val = sr->len (ssize_t gets -1) 2. io_recv_buf_select(): arg.max_len = sel->val (size_t gets 0xFFFFFFFFFFFFFFFF) 3. io_ring_buffers_peek(): buf->len is not clamped because max_len is astronomically large 4. iov[].iov_len = 0xFFFFFFFF flows into io_bundle_nbufs() 5. io_bundle_nbufs(): min_t(int, 0xFFFFFFFF, ret) yields -1, causing ret to increase instead of decrease, creating an infinite loop that reads past the allocated iov[] array This results in a slab-out-of-bounds read in io_bundle_nbufs() from the kmalloc-64 slab, as nbufs increments past the allocated iovec entries. BUG: KASAN: slab-out-of-bounds in io_bundle_nbufs+0x128/0x160 Read of size 8 at addr ffff888100ae05c8 by task exp/145 Call Trace: io_bundle_nbufs+0x128/0x160 io_recv_finish+0x117/0xe20 io_recv+0x2db/0x1160 Fix this by rejecting negative sr->len values early in both io_sendmsg_prep() and io_recvmsg_prep(). Since sqe->len is __u32, any value > INT_MAX indicates overflow and is not a valid length. Fixes: a05d1f625c7a ("io_uring/net: support bundles for send") Cc: stable@vger.kernel.org Signed-off-by: Junxi Qian Link: https://patch.msgid.link/20260329153909.279046-1-qjx1298677004@gmail.com Signed-off-by: Jens Axboe

io_uring/net: use 'ctx' consistently

2026-03-17T20:35:00+00:00

There's already a local ctx variable, use it for the io_is_compat() check as well. Signed-off-by: Jens Axboe

io_uring/zctx: separate notification user_data

2026-03-09T13:23:29+00:00

People previously asked for the notification CQE to have a different user_data value from the main request completion. It's useful to separate buffer and request handling logic and avoid separately refcounting the request. Let the user pass the notification user_data in sqe->addr3. If zero, it'll inherit sqe->user_data as before. It doesn't change the rules for when the user can expect a notification CQE, and it should still check the IORING_CQE_F_MORE flag. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe

io_uring/net: allow vectorised regbuf send zc

2026-03-09T13:22:09+00:00

Enable IORING_SEND_VECTORIZED with registered buffers for IORING_OP_SEND_ZC. Set IORING_SEND_VECTORIZED for all msg send requests to differentiate if the vectorised version is expected. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe

io_uring/zctx: unify zerocopy issue variants

2026-03-09T13:21:54+00:00

io_send_zc and io_sendmsg_zc started different but now the only real difference between them is how registered buffers are imported and which net helper we use. Avoid duplication and combine them into a single function. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe

io_uring/zctx: move vec regbuf import into io_send_zc_import

2026-03-09T13:21:53+00:00

Unify send and sendmsg zerocopy paths for importing registered buffers and make io_send_zc_import() responsible for that. It's a preparation patch making the next change simpler. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe

io_uring/zctx: rename flags var for more clarity

2026-03-09T13:21:53+00:00

The name "flags" is too overloaded, so rename the variable in io_sendmsg_zc() into msg_flags to stress that it contains MSG_*. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe

io_uring/net: reject SEND_VECTORIZED when unsupported

2026-03-02T16:17:04+00:00

IORING_SEND_VECTORIZED with registered buffers is not implemented but could be. Don't silently ignore the flag in this case but reject it with an error. It only affects sendzc as normal sends don't support registered buffers. Fixes: 6f02527729bd3 ("io_uring/net: Allow to do vectorized send") Cc: stable@vger.kernel.org Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe