[linux-2.6-block.git] / io_uring / msg_ring.c

// SPDX-License-Identifier: GPL-2.0
#include <linux/kernel.h>
#include <linux/errno.h>
#include <linux/file.h>
#include <linux/slab.h>
#include <linux/nospec.h>
#include <linux/io_uring.h>

#include <uapi/linux/io_uring.h>

#include "io_uring.h"
#include "rsrc.h"
#include "filetable.h"
#include "msg_ring.h"

struct io_msg {
	struct file			*file;
	struct file			*src_file;
	struct callback_head		tw;
	u64 user_data;
	u32 len;
	u32 cmd;
	u32 src_fd;
	u32 dst_fd;
	u32 flags;
};

void io_msg_ring_cleanup(struct io_kiocb *req)
{
	struct io_msg *msg = io_kiocb_to_cmd(req, struct io_msg);

	if (WARN_ON_ONCE(!msg->src_file))
		return;

	fput(msg->src_file);
	msg->src_file = NULL;
}

static void io_msg_tw_complete(struct callback_head *head)
{
	struct io_msg *msg = container_of(head, struct io_msg, tw);
	struct io_kiocb *req = cmd_to_io_kiocb(msg);
	struct io_ring_ctx *target_ctx = req->file->private_data;
	int ret = 0;

	if (current->flags & PF_EXITING)
		ret = -EOWNERDEAD;
	else if (!io_post_aux_cqe(target_ctx, msg->user_data, msg->len, 0))
		ret = -EOVERFLOW;

	if (ret < 0)
		req_set_fail(req);
	io_req_queue_tw_complete(req, ret);
}

static int io_msg_ring_data(struct io_kiocb *req)
{
	struct io_ring_ctx *target_ctx = req->file->private_data;
	struct io_msg *msg = io_kiocb_to_cmd(req, struct io_msg);

	if (msg->src_fd || msg->dst_fd || msg->flags)
		return -EINVAL;

	if (target_ctx->task_complete && current != target_ctx->submitter_task) {
		init_task_work(&msg->tw, io_msg_tw_complete);
		if (task_work_add(target_ctx->submitter_task, &msg->tw,
				  TWA_SIGNAL_NO_IPI))
			return -EOWNERDEAD;

		return IOU_ISSUE_SKIP_COMPLETE;
	}

	if (io_post_aux_cqe(target_ctx, msg->user_data, msg->len, 0))
		return 0;

	return -EOVERFLOW;
}

static void io_double_unlock_ctx(struct io_ring_ctx *octx,
				 unsigned int issue_flags)
{
	mutex_unlock(&octx->uring_lock);
}

static int io_double_lock_ctx(struct io_ring_ctx *octx,
			      unsigned int issue_flags)
{
	/*
	 * To ensure proper ordering between the two ctxs, we can only
	 * attempt a trylock on the target. If that fails and we already have
	 * the source ctx lock, punt to io-wq.
	 */
	if (!(issue_flags & IO_URING_F_UNLOCKED)) {
		if (!mutex_trylock(&octx->uring_lock))
			return -EAGAIN;
		return 0;
	}
	mutex_lock(&octx->uring_lock);
	return 0;
}

static struct file *io_msg_grab_file(struct io_kiocb *req, unsigned int issue_flags)
{
	struct io_msg *msg = io_kiocb_to_cmd(req, struct io_msg);
	struct io_ring_ctx *ctx = req->ctx;
	struct file *file = NULL;
	unsigned long file_ptr;
	int idx = msg->src_fd;

	io_ring_submit_lock(ctx, issue_flags);
	if (likely(idx < ctx->nr_user_files)) {
		idx = array_index_nospec(idx, ctx->nr_user_files);
		file_ptr = io_fixed_file_slot(&ctx->file_table, idx)->file_ptr;
		file = (struct file *) (file_ptr & FFS_MASK);
		if (file)
			get_file(file);
	}
	io_ring_submit_unlock(ctx, issue_flags);
	return file;
}

static int io_msg_install_complete(struct io_kiocb *req, unsigned int issue_flags)
{
	struct io_ring_ctx *target_ctx = req->file->private_data;
	struct io_msg *msg = io_kiocb_to_cmd(req, struct io_msg);
	struct file *src_file = msg->src_file;
	int ret;

	if (unlikely(io_double_lock_ctx(target_ctx, issue_flags)))
		return -EAGAIN;

	ret = __io_fixed_fd_install(target_ctx, src_file, msg->dst_fd);
	if (ret < 0)
		goto out_unlock;

	msg->src_file = NULL;
	req->flags &= ~REQ_F_NEED_CLEANUP;

	if (msg->flags & IORING_MSG_RING_CQE_SKIP)
		goto out_unlock;
	/*
	 * If this fails, the target still received the file descriptor but
	 * wasn't notified of the fact. This means that if this request
	 * completes with -EOVERFLOW, then the sender must ensure that a
	 * later IORING_OP_MSG_RING delivers the message.
	 */
	if (!io_post_aux_cqe(target_ctx, msg->user_data, msg->len, 0))
		ret = -EOVERFLOW;
out_unlock:
	io_double_unlock_ctx(target_ctx, issue_flags);
	return ret;
}

static void io_msg_tw_fd_complete(struct callback_head *head)
{
	struct io_msg *msg = container_of(head, struct io_msg, tw);
	struct io_kiocb *req = cmd_to_io_kiocb(msg);
	int ret = -EOWNERDEAD;

	if (!(current->flags & PF_EXITING))
		ret = io_msg_install_complete(req, IO_URING_F_UNLOCKED);
	if (ret < 0)
		req_set_fail(req);
	io_req_queue_tw_complete(req, ret);
}

static int io_msg_send_fd(struct io_kiocb *req, unsigned int issue_flags)
{
	struct io_ring_ctx *target_ctx = req->file->private_data;
	struct io_msg *msg = io_kiocb_to_cmd(req, struct io_msg);
	struct io_ring_ctx *ctx = req->ctx;
	struct file *src_file = msg->src_file;

	if (target_ctx == ctx)
		return -EINVAL;
	if (!src_file) {
		src_file = io_msg_grab_file(req, issue_flags);
		if (!src_file)
			return -EBADF;
		msg->src_file = src_file;
		req->flags |= REQ_F_NEED_CLEANUP;
	}

	if (target_ctx->task_complete && current != target_ctx->submitter_task) {
		init_task_work(&msg->tw, io_msg_tw_fd_complete);
		if (task_work_add(target_ctx->submitter_task, &msg->tw,
				  TWA_SIGNAL))
			return -EOWNERDEAD;

		return IOU_ISSUE_SKIP_COMPLETE;
	}
	return io_msg_install_complete(req, issue_flags);
}

int io_msg_ring_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
{
	struct io_msg *msg = io_kiocb_to_cmd(req, struct io_msg);

	if (unlikely(sqe->buf_index || sqe->personality))
		return -EINVAL;

	msg->src_file = NULL;
	msg->user_data = READ_ONCE(sqe->off);
	msg->len = READ_ONCE(sqe->len);
	msg->cmd = READ_ONCE(sqe->addr);
	msg->src_fd = READ_ONCE(sqe->addr3);
	msg->dst_fd = READ_ONCE(sqe->file_index);
	msg->flags = READ_ONCE(sqe->msg_ring_flags);
	if (msg->flags & ~IORING_MSG_RING_CQE_SKIP)
		return -EINVAL;

	return 0;
}

int io_msg_ring(struct io_kiocb *req, unsigned int issue_flags)
{
	struct io_msg *msg = io_kiocb_to_cmd(req, struct io_msg);
	int ret;

	ret = -EBADFD;
	if (!io_is_uring_fops(req->file))
		goto done;

	switch (msg->cmd) {
	case IORING_MSG_DATA:
		ret = io_msg_ring_data(req);
		break;
	case IORING_MSG_SEND_FD:
		ret = io_msg_send_fd(req, issue_flags);
		break;
	default:
		ret = -EINVAL;
		break;
	}

done:
	if (ret < 0) {
		if (ret == -EAGAIN || ret == IOU_ISSUE_SKIP_COMPLETE)
			return ret;
		req_set_fail(req);
	}
	io_req_set_res(req, ret, 0);
	return IOU_OK;
}
Commit	Line	Data
36404b09 JA	1	// SPDX-License-Identifier: GPL-2.0
	2	#include <linux/kernel.h>
	3	#include <linux/errno.h>
	4	#include <linux/file.h>
	5	#include <linux/slab.h>
e6130eba	6	#include <linux/nospec.h>
36404b09 JA	7	#include <linux/io_uring.h>
	8
	9	#include <uapi/linux/io_uring.h>
	10
36404b09	11	#include "io_uring.h"
e6130eba JA	12	#include "rsrc.h"
e6130eba JA	13	#include "filetable.h"
36404b09 JA	14	#include "msg_ring.h"
	15
	16	struct io_msg {
	17	struct file *file;
11373026	18	struct file *src_file;
6d043ee1	19	struct callback_head tw;
36404b09 JA	20	u64 user_data;
36404b09 JA	21	u32 len;
e6130eba JA	22	u32 cmd;
	23	u32 src_fd;
	24	u32 dst_fd;
	25	u32 flags;
36404b09 JA	26	};
36404b09 JA	27
11373026 PB	28	void io_msg_ring_cleanup(struct io_kiocb *req)
	29	{
	30	struct io_msg *msg = io_kiocb_to_cmd(req, struct io_msg);
	31
	32	if (WARN_ON_ONCE(!msg->src_file))
	33	return;
	34
	35	fput(msg->src_file);
	36	msg->src_file = NULL;
	37	}
	38
6d043ee1 PB	39	static void io_msg_tw_complete(struct callback_head *head)
	40	{
	41	struct io_msg *msg = container_of(head, struct io_msg, tw);
	42	struct io_kiocb *req = cmd_to_io_kiocb(msg);
	43	struct io_ring_ctx *target_ctx = req->file->private_data;
	44	int ret = 0;
	45
	46	if (current->flags & PF_EXITING)
	47	ret = -EOWNERDEAD;
	48	else if (!io_post_aux_cqe(target_ctx, msg->user_data, msg->len, 0))
	49	ret = -EOVERFLOW;
	50
	51	if (ret < 0)
	52	req_set_fail(req);
	53	io_req_queue_tw_complete(req, ret);
	54	}
	55
e6130eba JA	56	static int io_msg_ring_data(struct io_kiocb *req)
	57	{
	58	struct io_ring_ctx *target_ctx = req->file->private_data;
f2ccb5ae	59	struct io_msg *msg = io_kiocb_to_cmd(req, struct io_msg);
e6130eba JA	60
	61	if (msg->src_fd \|\| msg->dst_fd \|\| msg->flags)
	62	return -EINVAL;
	63
6d043ee1 PB	64	if (target_ctx->task_complete && current != target_ctx->submitter_task) {
	65	init_task_work(&msg->tw, io_msg_tw_complete);
	66	if (task_work_add(target_ctx->submitter_task, &msg->tw,
	67	TWA_SIGNAL_NO_IPI))
	68	return -EOWNERDEAD;
	69
	70	return IOU_ISSUE_SKIP_COMPLETE;
	71	}
	72
b529c96a	73	if (io_post_aux_cqe(target_ctx, msg->user_data, msg->len, 0))
e6130eba JA	74	return 0;
	75
	76	return -EOVERFLOW;
	77	}
	78
11373026	79	static void io_double_unlock_ctx(struct io_ring_ctx *octx,
e6130eba JA	80	unsigned int issue_flags)
e6130eba JA	81	{
e6130eba JA	82	mutex_unlock(&octx->uring_lock);
	83	}
	84
11373026	85	static int io_double_lock_ctx(struct io_ring_ctx *octx,
e6130eba JA	86	unsigned int issue_flags)
	87	{
	88	/*
	89	* To ensure proper ordering between the two ctxs, we can only
	90	* attempt a trylock on the target. If that fails and we already have
	91	* the source ctx lock, punt to io-wq.
	92	*/
	93	if (!(issue_flags & IO_URING_F_UNLOCKED)) {
	94	if (!mutex_trylock(&octx->uring_lock))
	95	return -EAGAIN;
	96	return 0;
	97	}
11373026 PB	98	mutex_lock(&octx->uring_lock);
	99	return 0;
	100	}
e6130eba	101
11373026 PB	102	static struct file io_msg_grab_file(struct io_kiocb req, unsigned int issue_flags)
	103	{
	104	struct io_msg *msg = io_kiocb_to_cmd(req, struct io_msg);
	105	struct io_ring_ctx *ctx = req->ctx;
	106	struct file *file = NULL;
	107	unsigned long file_ptr;
	108	int idx = msg->src_fd;
	109
	110	io_ring_submit_lock(ctx, issue_flags);
	111	if (likely(idx < ctx->nr_user_files)) {
	112	idx = array_index_nospec(idx, ctx->nr_user_files);
	113	file_ptr = io_fixed_file_slot(&ctx->file_table, idx)->file_ptr;
	114	file = (struct file *) (file_ptr & FFS_MASK);
	115	if (file)
	116	get_file(file);
e6130eba	117	}
11373026 PB	118	io_ring_submit_unlock(ctx, issue_flags);
11373026 PB	119	return file;
e6130eba JA	120	}
e6130eba JA	121
17211310	122	static int io_msg_install_complete(struct io_kiocb *req, unsigned int issue_flags)
e6130eba JA	123	{
e6130eba JA	124	struct io_ring_ctx *target_ctx = req->file->private_data;
f2ccb5ae	125	struct io_msg *msg = io_kiocb_to_cmd(req, struct io_msg);
11373026	126	struct file *src_file = msg->src_file;
e6130eba JA	127	int ret;
e6130eba JA	128
11373026 PB	129	if (unlikely(io_double_lock_ctx(target_ctx, issue_flags)))
11373026 PB	130	return -EAGAIN;
e6130eba JA	131
e6130eba JA	132	ret = __io_fixed_fd_install(target_ctx, src_file, msg->dst_fd);
11373026	133	if (ret < 0)
e6130eba	134	goto out_unlock;
17211310	135
11373026 PB	136	msg->src_file = NULL;
11373026 PB	137	req->flags &= ~REQ_F_NEED_CLEANUP;
e6130eba JA	138
	139	if (msg->flags & IORING_MSG_RING_CQE_SKIP)
	140	goto out_unlock;
e6130eba JA	141	/*
	142	* If this fails, the target still received the file descriptor but
	143	* wasn't notified of the fact. This means that if this request
	144	* completes with -EOVERFLOW, then the sender must ensure that a
	145	* later IORING_OP_MSG_RING delivers the message.
	146	*/
b529c96a	147	if (!io_post_aux_cqe(target_ctx, msg->user_data, msg->len, 0))
e6130eba JA	148	ret = -EOVERFLOW;
e6130eba JA	149	out_unlock:
11373026	150	io_double_unlock_ctx(target_ctx, issue_flags);
e6130eba JA	151	return ret;
	152	}
	153
6d043ee1 PB	154	static void io_msg_tw_fd_complete(struct callback_head *head)
	155	{
	156	struct io_msg *msg = container_of(head, struct io_msg, tw);
	157	struct io_kiocb *req = cmd_to_io_kiocb(msg);
	158	int ret = -EOWNERDEAD;
	159
	160	if (!(current->flags & PF_EXITING))
	161	ret = io_msg_install_complete(req, IO_URING_F_UNLOCKED);
	162	if (ret < 0)
	163	req_set_fail(req);
	164	io_req_queue_tw_complete(req, ret);
	165	}
	166
17211310 PB	167	static int io_msg_send_fd(struct io_kiocb *req, unsigned int issue_flags)
	168	{
	169	struct io_ring_ctx *target_ctx = req->file->private_data;
	170	struct io_msg *msg = io_kiocb_to_cmd(req, struct io_msg);
	171	struct io_ring_ctx *ctx = req->ctx;
	172	struct file *src_file = msg->src_file;
	173
	174	if (target_ctx == ctx)
	175	return -EINVAL;
	176	if (!src_file) {
	177	src_file = io_msg_grab_file(req, issue_flags);
	178	if (!src_file)
	179	return -EBADF;
	180	msg->src_file = src_file;
	181	req->flags \|= REQ_F_NEED_CLEANUP;
	182	}
6d043ee1 PB	183
	184	if (target_ctx->task_complete && current != target_ctx->submitter_task) {
	185	init_task_work(&msg->tw, io_msg_tw_fd_complete);
	186	if (task_work_add(target_ctx->submitter_task, &msg->tw,
	187	TWA_SIGNAL))
	188	return -EOWNERDEAD;
	189
	190	return IOU_ISSUE_SKIP_COMPLETE;
	191	}
17211310 PB	192	return io_msg_install_complete(req, issue_flags);
	193	}
	194
36404b09 JA	195	int io_msg_ring_prep(struct io_kiocb req, const struct io_uring_sqe sqe)
36404b09 JA	196	{
f2ccb5ae	197	struct io_msg *msg = io_kiocb_to_cmd(req, struct io_msg);
36404b09	198
e6130eba	199	if (unlikely(sqe->buf_index \|\| sqe->personality))
36404b09 JA	200	return -EINVAL;
36404b09 JA	201
11373026	202	msg->src_file = NULL;
36404b09 JA	203	msg->user_data = READ_ONCE(sqe->off);
36404b09 JA	204	msg->len = READ_ONCE(sqe->len);
e6130eba JA	205	msg->cmd = READ_ONCE(sqe->addr);
	206	msg->src_fd = READ_ONCE(sqe->addr3);
	207	msg->dst_fd = READ_ONCE(sqe->file_index);
	208	msg->flags = READ_ONCE(sqe->msg_ring_flags);
	209	if (msg->flags & ~IORING_MSG_RING_CQE_SKIP)
	210	return -EINVAL;
	211
36404b09 JA	212	return 0;
	213	}
	214
	215	int io_msg_ring(struct io_kiocb *req, unsigned int issue_flags)
	216	{
f2ccb5ae	217	struct io_msg *msg = io_kiocb_to_cmd(req, struct io_msg);
36404b09 JA	218	int ret;
	219
	220	ret = -EBADFD;
	221	if (!io_is_uring_fops(req->file))
	222	goto done;
	223
e6130eba JA	224	switch (msg->cmd) {
	225	case IORING_MSG_DATA:
	226	ret = io_msg_ring_data(req);
	227	break;
	228	case IORING_MSG_SEND_FD:
	229	ret = io_msg_send_fd(req, issue_flags);
	230	break;
	231	default:
	232	ret = -EINVAL;
	233	break;
	234	}
36404b09 JA	235
36404b09 JA	236	done:
6d043ee1 PB	237	if (ret < 0) {
	238	if (ret == -EAGAIN \|\| ret == IOU_ISSUE_SKIP_COMPLETE)
	239	return ret;
36404b09	240	req_set_fail(req);
6d043ee1	241	}
36404b09	242	io_req_set_res(req, ret, 0);
36404b09 JA	243	return IOU_OK;
36404b09 JA	244	}