From: Linus Torvalds <torvalds@linux-foundation.org>
Date: Sat, 11 Sep 2021 17:28:14 +0000 (-0700)
Subject: Merge tag 'io_uring-5.15-2021-09-11' of git://git.kernel.dk/linux-block
X-Git-Tag: microblaze-v5.16~16
X-Git-Url: http://git.monstr.eu/?p=linux-2.6-microblaze.git;a=commitdiff_plain;h=c605c39677b9842b0566013e0cf30bc13e90bdbc;hp=-c

Merge tag 'io_uring-5.15-2021-09-11' of git://git.kernel.dk/linux-block

Pull io_uring fixes from Jens Axboe:

 - Fix an off-by-one in a BUILD_BUG_ON() check. Not a real issue right
   now as we have plenty of flags left, but could become one. (Hao)

 - Fix lockdep issue introduced in this merge window (me)

 - Fix a few issues with the worker creation (me, Pavel, Qiang)

 - Fix regression with wq_has_sleeper() for IOPOLL (Pavel)

 - Timeout link error propagation fix (Pavel)

* tag 'io_uring-5.15-2021-09-11' of git://git.kernel.dk/linux-block:
  io_uring: fix off-by-one in BUILD_BUG_ON check of __REQ_F_LAST_BIT
  io_uring: fail links of cancelled timeouts
  io-wq: fix memory leak in create_io_worker()
  io-wq: fix silly logic error in io_task_work_match()
  io_uring: drop ctx->uring_lock before acquiring sqd->lock
  io_uring: fix missing mb() before waitqueue_active
  io-wq: fix cancellation on create-worker failure
---

c605c39677b9842b0566013e0cf30bc13e90bdbc
diff --combined fs/io_uring.c
index 855ea544807f,f795ad281038..16fb7436043c
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@@ -1482,6 -1482,8 +1482,8 @@@ static void io_kill_timeout(struct io_k
  	struct io_timeout_data *io = req->async_data;
  
  	if (hrtimer_try_to_cancel(&io->timer) != -1) {
+ 		if (status)
+ 			req_set_fail(req);
  		atomic_set(&req->ctx->cq_timeouts,
  			atomic_read(&req->ctx->cq_timeouts) + 1);
  		list_del_init(&req->timeout.list);
@@@ -1619,8 -1621,11 +1621,11 @@@ static void io_cqring_ev_posted(struct 
  
  static void io_cqring_ev_posted_iopoll(struct io_ring_ctx *ctx)
  {
+ 	/* see waitqueue_active() comment */
+ 	smp_mb();
+ 
  	if (ctx->flags & IORING_SETUP_SQPOLL) {
- 		if (wq_has_sleeper(&ctx->cq_wait))
+ 		if (waitqueue_active(&ctx->cq_wait))
  			wake_up_all(&ctx->cq_wait);
  	}
  	if (io_should_trigger_evfd(ctx))
@@@ -3480,7 -3485,6 +3485,7 @@@ static int io_read(struct io_kiocb *req
  		if (req->flags & REQ_F_NOWAIT)
  			goto done;
  		/* some cases will consume bytes even on error returns */
 +		iov_iter_reexpand(iter, iter->count + iter->truncated);
  		iov_iter_revert(iter, io_size - iov_iter_count(iter));
  		ret = 0;
  	} else if (ret == -EIOCBQUEUED) {
@@@ -3620,7 -3624,6 +3625,7 @@@ done
  	} else {
  copy_iov:
  		/* some cases will consume bytes even on error returns */
 +		iov_iter_reexpand(iter, iter->count + iter->truncated);
  		iov_iter_revert(iter, io_size - iov_iter_count(iter));
  		ret = io_setup_async_rw(req, iovec, inline_vecs, iter, false);
  		return ret ?: -EAGAIN;
@@@ -10550,7 -10553,14 +10555,14 @@@ static int io_register_iowq_max_workers
  	if (ctx->flags & IORING_SETUP_SQPOLL) {
  		sqd = ctx->sq_data;
  		if (sqd) {
+ 			/*
+ 			 * Observe the correct sqd->lock -> ctx->uring_lock
+ 			 * ordering. Fine to drop uring_lock here, we hold
+ 			 * a ref to the ctx.
+ 			 */
+ 			mutex_unlock(&ctx->uring_lock);
  			mutex_lock(&sqd->lock);
+ 			mutex_lock(&ctx->uring_lock);
  			tctx = sqd->thread->io_uring;
  		}
  	} else {
@@@ -10853,7 -10863,7 +10865,7 @@@ static int __init io_uring_init(void
  	BUILD_BUG_ON(SQE_VALID_FLAGS >= (1 << 8));
  
  	BUILD_BUG_ON(ARRAY_SIZE(io_op_defs) != IORING_OP_LAST);
- 	BUILD_BUG_ON(__REQ_F_LAST_BIT >= 8 * sizeof(int));
+ 	BUILD_BUG_ON(__REQ_F_LAST_BIT > 8 * sizeof(int));
  
  	req_cachep = KMEM_CACHE(io_kiocb, SLAB_HWCACHE_ALIGN | SLAB_PANIC |
  				SLAB_ACCOUNT);