Jens Axboe 3b53dc1c64 io_uring/net: commit partial buffers on retry ... Commit 41b70df5b3 upstream. Ring provided buffers are potentially only valid within the single execution context in which they were acquired. io_uring deals with this and invalidates them on retry. But on the networking side, if MSG_WAITALL is set, or if the socket is of the streaming type and too little was processed, then it will hang on to the buffer rather than recycle or commit it. This is problematic for two reasons: 1) If someone unregisters the provided buffer ring before a later retry, then the req->buf_list will no longer be valid. 2) If multiple sockers are using the same buffer group, then multiple receives can consume the same memory. This can cause data corruption in the application, as either receive could land in the same userspace buffer. Fix this by disallowing partial retries from pinning a provided buffer across multiple executions, if ring provided buffers are used. Cc: stable@vger.kernel.org Reported-by: pt x <superman.xpt@gmail.com> Fixes: c56e022c0a ("io_uring: add support for user mapped provided buffer ring") Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2025-08-28 16:28:11 +02:00
..
advise.c
advise.h
alloc_cache.h
cancel.c
cancel.h
epoll.c
epoll.h
fdinfo.c	io_uring/fdinfo: annotate racy sq/cq head/tail reads	2025-06-04 14:42:16 +02:00
fdinfo.h
filetable.c
filetable.h
fs.c
fs.h
io_uring.c	io_uring: account drain memory to cgroup	2025-06-27 11:08:43 +01:00
io_uring.h	io_uring: add io_file_can_poll() helper	2025-06-19 15:28:44 +02:00
io-wq.c	io_uring: fix task leak issue in io_wq_create()	2025-06-27 11:08:58 +01:00
io-wq.h
kbuf.c	io_uring/kbuf: account ring io_buffer_list memory	2025-06-27 11:08:43 +01:00
kbuf.h	io_uring/kbuf: use vm_insert_pages() for mmap'ed pbuf ring	2025-03-22 12:50:45 -07:00
Makefile
msg_ring.c
msg_ring.h
net.c	io_uring/net: commit partial buffers on retry	2025-08-28 16:28:11 +02:00
net.h
nop.c
nop.h
notif.c
notif.h
opdef.c	io_uring: make fallocate be hashed work	2025-07-17 18:35:20 +02:00
opdef.h
openclose.c
openclose.h
poll.c	io_uring/poll: fix POLLERR handling	2025-07-24 08:53:12 +02:00
poll.h
refs.h	io_uring: always do atomic put from iowq	2025-05-02 07:50:57 +02:00
rsrc.c	io_uring: unify io_pin_pages()	2025-03-22 12:50:45 -07:00
rsrc.h
rw.c	io_uring/rw: fix wrong NOWAIT check in io_rw_init_file()	2025-06-19 15:28:45 +02:00
rw.h
slist.h
splice.c
splice.h
sqpoll.c
sqpoll.h
statx.c
statx.h
sync.c
sync.h
tctx.c
tctx.h
timeout.c
timeout.h
uring_cmd.c
uring_cmd.h
xattr.c
xattr.h