1 #include <linux/kernel.h> 2 #include <linux/errno.h> 3 #include <linux/file.h> 4 #include <linux/slab.h> 5 #include <linux/net.h> 6 #include <linux/io_uring.h> 7 8 #include "io_uring.h" 9 #include "notif.h" 10 #include "rsrc.h" 11 12 static void __io_notif_complete_tw(struct io_kiocb *notif, bool *locked) 13 { 14 struct io_notif_data *nd = io_notif_to_data(notif); 15 struct io_ring_ctx *ctx = notif->ctx; 16 17 if (nd->account_pages && ctx->user) { 18 __io_unaccount_mem(ctx->user, nd->account_pages); 19 nd->account_pages = 0; 20 } 21 io_req_task_complete(notif, locked); 22 } 23 24 static inline void io_notif_complete(struct io_kiocb *notif) 25 __must_hold(¬if->ctx->uring_lock) 26 { 27 bool locked = true; 28 29 __io_notif_complete_tw(notif, &locked); 30 } 31 32 static void io_uring_tx_zerocopy_callback(struct sk_buff *skb, 33 struct ubuf_info *uarg, 34 bool success) 35 { 36 struct io_notif_data *nd = container_of(uarg, struct io_notif_data, uarg); 37 struct io_kiocb *notif = cmd_to_io_kiocb(nd); 38 39 if (refcount_dec_and_test(&uarg->refcnt)) { 40 notif->io_task_work.func = __io_notif_complete_tw; 41 io_req_task_work_add(notif); 42 } 43 } 44 45 struct io_kiocb *io_alloc_notif(struct io_ring_ctx *ctx, 46 struct io_notif_slot *slot) 47 __must_hold(&ctx->uring_lock) 48 { 49 struct io_kiocb *notif; 50 struct io_notif_data *nd; 51 52 if (unlikely(!io_alloc_req_refill(ctx))) 53 return NULL; 54 notif = io_alloc_req(ctx); 55 notif->opcode = IORING_OP_NOP; 56 notif->flags = 0; 57 notif->file = NULL; 58 notif->task = current; 59 io_get_task_refs(1); 60 notif->rsrc_node = NULL; 61 io_req_set_rsrc_node(notif, ctx, 0); 62 notif->cqe.user_data = slot->tag; 63 notif->cqe.flags = slot->seq++; 64 notif->cqe.res = 0; 65 66 nd = io_notif_to_data(notif); 67 nd->account_pages = 0; 68 nd->uarg.flags = SKBFL_ZEROCOPY_FRAG | SKBFL_DONT_ORPHAN; 69 nd->uarg.callback = io_uring_tx_zerocopy_callback; 70 /* master ref owned by io_notif_slot, will be dropped on flush */ 71 refcount_set(&nd->uarg.refcnt, 1); 72 return notif; 73 } 74 75 void io_notif_slot_flush(struct io_notif_slot *slot) 76 __must_hold(&ctx->uring_lock) 77 { 78 struct io_kiocb *notif = slot->notif; 79 struct io_notif_data *nd = io_notif_to_data(notif); 80 81 slot->notif = NULL; 82 83 /* drop slot's master ref */ 84 if (refcount_dec_and_test(&nd->uarg.refcnt)) 85 io_notif_complete(notif); 86 } 87 88 __cold int io_notif_unregister(struct io_ring_ctx *ctx) 89 __must_hold(&ctx->uring_lock) 90 { 91 int i; 92 93 if (!ctx->notif_slots) 94 return -ENXIO; 95 96 for (i = 0; i < ctx->nr_notif_slots; i++) { 97 struct io_notif_slot *slot = &ctx->notif_slots[i]; 98 struct io_kiocb *notif = slot->notif; 99 struct io_notif_data *nd; 100 101 if (!notif) 102 continue; 103 nd = io_kiocb_to_cmd(notif); 104 slot->notif = NULL; 105 if (!refcount_dec_and_test(&nd->uarg.refcnt)) 106 continue; 107 notif->io_task_work.func = __io_notif_complete_tw; 108 io_req_task_work_add(notif); 109 } 110 111 kvfree(ctx->notif_slots); 112 ctx->notif_slots = NULL; 113 ctx->nr_notif_slots = 0; 114 return 0; 115 } 116 117 __cold int io_notif_register(struct io_ring_ctx *ctx, 118 void __user *arg, unsigned int size) 119 __must_hold(&ctx->uring_lock) 120 { 121 struct io_uring_notification_slot __user *slots; 122 struct io_uring_notification_slot slot; 123 struct io_uring_notification_register reg; 124 unsigned i; 125 126 BUILD_BUG_ON(sizeof(struct io_notif_data) > 64); 127 128 if (ctx->nr_notif_slots) 129 return -EBUSY; 130 if (size != sizeof(reg)) 131 return -EINVAL; 132 if (copy_from_user(®, arg, sizeof(reg))) 133 return -EFAULT; 134 if (!reg.nr_slots || reg.nr_slots > IORING_MAX_NOTIF_SLOTS) 135 return -EINVAL; 136 if (reg.resv || reg.resv2 || reg.resv3) 137 return -EINVAL; 138 139 slots = u64_to_user_ptr(reg.data); 140 ctx->notif_slots = kvcalloc(reg.nr_slots, sizeof(ctx->notif_slots[0]), 141 GFP_KERNEL_ACCOUNT); 142 if (!ctx->notif_slots) 143 return -ENOMEM; 144 145 for (i = 0; i < reg.nr_slots; i++, ctx->nr_notif_slots++) { 146 struct io_notif_slot *notif_slot = &ctx->notif_slots[i]; 147 148 if (copy_from_user(&slot, &slots[i], sizeof(slot))) { 149 io_notif_unregister(ctx); 150 return -EFAULT; 151 } 152 if (slot.resv[0] | slot.resv[1] | slot.resv[2]) { 153 io_notif_unregister(ctx); 154 return -EINVAL; 155 } 156 notif_slot->tag = slot.tag; 157 } 158 return 0; 159 } 160