FAILED: patch "[PATCH] io_uring/rw: ensure io->bytes_done is always initialized" failed to apply to 5.15-stable tree

The patch below does not apply to the 5.15-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y
git checkout FETCH_HEAD
git cherry-pick -x 0a535eddbe0dc1de4386046ab849f08aeb2f8faf
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2024012216-depth-bartender-bc38@gregkh' --subject-prefix 'PATCH 5.15.y' HEAD^..

Possible dependencies:

0a535eddbe0d ("io_uring/rw: ensure io->bytes_done is always initialized") f3b44f92e59a ("io_uring: move read/write related opcodes to its own file") c98817e6cd44 ("io_uring: move remaining file table manipulation to filetable.c") 735729844819 ("io_uring: move rsrc related data, core, and commands") 3b77495a9723 ("io_uring: split provided buffers handling into its own file") 7aaff708a768 ("io_uring: move cancelation into its own file") 329061d3e2f9 ("io_uring: move poll handling into its own file") cfd22e6b3319 ("io_uring: add opcode name to io_op_defs") 92ac8beaea1f ("io_uring: include and forward-declaration sanitation") c9f06aa7de15 ("io_uring: move io_uring_task (tctx) helpers into its own file") a4ad4f748ea9 ("io_uring: move fdinfo helpers to its own file") e5550a1447bf ("io_uring: use io_is_uring_fops() consistently") 17437f311490 ("io_uring: move SQPOLL related handling into its own file") 59915143e89f ("io_uring: move timeout opcodes and handling into its own file") e418bbc97bff ("io_uring: move our reference counting into a header") 36404b09aa60 ("io_uring: move msg_ring into its own file") f9ead18c1058 ("io_uring: split network related opcodes into its own file") e0da14def1ee ("io_uring: move statx handling to its own file") a9c210cebe13 ("io_uring: move epoll handler to its own file") 4cf90495281b ("io_uring: add a dummy -EOPNOTSUPP prep handler")

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 0a535eddbe0dc1de4386046ab849f08aeb2f8faf Mon Sep 17 00:00:00 2001
From: Jens Axboe <[email protected]>
Date: Thu, 21 Dec 2023 08:49:18 -0700
Subject: [PATCH] io_uring/rw: ensure io->bytes_done is always initialized

If IOSQE_ASYNC is set and we fail importing an iovec for a readv or writev request, then we leave ->bytes_done uninitialized and hence the eventual failure CQE posted can potentially have a random res value rather than the expected -EINVAL.

Setup ->bytes_done before potentially failing, so we have a consistent value if we fail the request early.

index 4943d683508b..0c856726b15d 100644
@@ -589,15 +589,19 @@ static inline int io_rw_prep_async(struct io_kiocb *req, int rw)
 	struct iovec *iov;
 	int ret;
 
+	iorw->bytes_done = 0;
+	iorw->free_iovec = NULL;
+
 	/* submission path, ->uring_lock should already be taken */
 	ret = io_import_iovec(rw, req, &iov, &iorw->s, 0);
 	if (unlikely(ret < 0))
 		return ret;
 
-	iorw->bytes_done = 0;
-	iorw->free_iovec = iov;
-	if (iov)
+	if (iov) {
+		iorw->free_iovec = iov;
 		req->flags |= REQ_F_NEED_CLEANUP;
+	}
+
 	return 0;
 }
 

This one applies to 5.10 and 5.15 stable, it should go into both. It's the same patch, just in the older bigger unified file.

Jens Axboe

From 2fb96ecf68bc1fb55508d22ebaf9518eaeb1a088 Mon Sep 17 00:00:00 2001
From: Jens Axboe <[email protected]>
Date: Mon, 22 Jan 2024 12:30:07 -0700
Subject: [PATCH] io_uring/rw: ensure io->bytes_done is always initialized

commit 0a535eddbe0dc1de4386046ab849f08aeb2f8faf upstream.

If IOSQE_ASYNC is set and we fail importing an iovec for a readv or writev request, then we leave ->bytes_done uninitialized and hence the eventual failure CQE posted can potentially have a random res value rather than the expected -EINVAL.

Setup ->bytes_done before potentially failing, so we have a consistent value if we fail the request early.

---
 io_uring/io_uring.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

index 30535d4edee7..55fd6d98fe12 100644
@@ -3490,14 +3490,17 @@ static inline int io_rw_prep_async(struct io_kiocb *req, int rw)
 	struct iovec *iov = iorw->fast_iov;
 	int ret;
 
+	iorw->bytes_done = 0;
+	iorw->free_iovec = NULL;
+
 	ret = io_import_iovec(rw, req, &iov, &iorw->iter, false);
 	if (unlikely(ret < 0))
 		return ret;
 
-	iorw->bytes_done = 0;
-	iorw->free_iovec = iov;
-	if (iov)
+	if (iov) {
+		iorw->free_iovec = iov;
 		req->flags |= REQ_F_NEED_CLEANUP;
+	}
 	iov_iter_save_state(&iorw->iter, &iorw->iter_state);
 	return 0;
 }

2.43.0

Now queued up, thanks.

greg k-h