[mirror_ubuntu-kernels.git] / io_uring / msg_ring.c

// SPDX-License-Identifier: GPL-2.0
#include <linux/kernel.h>
#include <linux/errno.h>
#include <linux/file.h>
#include <linux/slab.h>
#include <linux/nospec.h>
#include <linux/io_uring.h>

#include <uapi/linux/io_uring.h>

#include "io_uring.h"
#include "rsrc.h"
#include "filetable.h"
#include "msg_ring.h"

struct io_msg {
	struct file			*file;
	struct file			*src_file;
	struct callback_head		tw;
	u64 user_data;
	u32 len;
	u32 cmd;
	u32 src_fd;
	u32 dst_fd;
	u32 flags;
};

void io_msg_ring_cleanup(struct io_kiocb *req)
{
	struct io_msg *msg = io_kiocb_to_cmd(req, struct io_msg);

	if (WARN_ON_ONCE(!msg->src_file))
		return;

	fput(msg->src_file);
	msg->src_file = NULL;
}

static void io_msg_tw_complete(struct callback_head *head)
{
	struct io_msg *msg = container_of(head, struct io_msg, tw);
	struct io_kiocb *req = cmd_to_io_kiocb(msg);
	struct io_ring_ctx *target_ctx = req->file->private_data;
	int ret = 0;

	if (current->flags & PF_EXITING)
		ret = -EOWNERDEAD;
	else if (!io_post_aux_cqe(target_ctx, msg->user_data, msg->len, 0))
		ret = -EOVERFLOW;

	if (ret < 0)
		req_set_fail(req);
	io_req_queue_tw_complete(req, ret);
}

static int io_msg_ring_data(struct io_kiocb *req)
{
	struct io_ring_ctx *target_ctx = req->file->private_data;
	struct io_msg *msg = io_kiocb_to_cmd(req, struct io_msg);

	if (msg->src_fd || msg->dst_fd || msg->flags)
		return -EINVAL;

	if (target_ctx->task_complete && current != target_ctx->submitter_task) {
		init_task_work(&msg->tw, io_msg_tw_complete);
		if (task_work_add(target_ctx->submitter_task, &msg->tw,
				  TWA_SIGNAL_NO_IPI))
			return -EOWNERDEAD;

		atomic_or(IORING_SQ_TASKRUN, &target_ctx->rings->sq_flags);
		return IOU_ISSUE_SKIP_COMPLETE;
	}

	if (io_post_aux_cqe(target_ctx, msg->user_data, msg->len, 0))
		return 0;

	return -EOVERFLOW;
}

static void io_double_unlock_ctx(struct io_ring_ctx *octx,
				 unsigned int issue_flags)
{
	mutex_unlock(&octx->uring_lock);
}

static int io_double_lock_ctx(struct io_ring_ctx *octx,
			      unsigned int issue_flags)
{
	/*
	 * To ensure proper ordering between the two ctxs, we can only
	 * attempt a trylock on the target. If that fails and we already have
	 * the source ctx lock, punt to io-wq.
	 */
	if (!(issue_flags & IO_URING_F_UNLOCKED)) {
		if (!mutex_trylock(&octx->uring_lock))
			return -EAGAIN;
		return 0;
	}
	mutex_lock(&octx->uring_lock);
	return 0;
}

static struct file *io_msg_grab_file(struct io_kiocb *req, unsigned int issue_flags)
{
	struct io_msg *msg = io_kiocb_to_cmd(req, struct io_msg);
	struct io_ring_ctx *ctx = req->ctx;
	struct file *file = NULL;
	unsigned long file_ptr;
	int idx = msg->src_fd;

	io_ring_submit_lock(ctx, issue_flags);
	if (likely(idx < ctx->nr_user_files)) {
		idx = array_index_nospec(idx, ctx->nr_user_files);
		file_ptr = io_fixed_file_slot(&ctx->file_table, idx)->file_ptr;
		file = (struct file *) (file_ptr & FFS_MASK);
		if (file)
			get_file(file);
	}
	io_ring_submit_unlock(ctx, issue_flags);
	return file;
}

static int io_msg_install_complete(struct io_kiocb *req, unsigned int issue_flags)
{
	struct io_ring_ctx *target_ctx = req->file->private_data;
	struct io_msg *msg = io_kiocb_to_cmd(req, struct io_msg);
	struct file *src_file = msg->src_file;
	int ret;

	if (unlikely(io_double_lock_ctx(target_ctx, issue_flags)))
		return -EAGAIN;

	ret = __io_fixed_fd_install(target_ctx, src_file, msg->dst_fd);
	if (ret < 0)
		goto out_unlock;

	msg->src_file = NULL;
	req->flags &= ~REQ_F_NEED_CLEANUP;

	if (msg->flags & IORING_MSG_RING_CQE_SKIP)
		goto out_unlock;
	/*
	 * If this fails, the target still received the file descriptor but
	 * wasn't notified of the fact. This means that if this request
	 * completes with -EOVERFLOW, then the sender must ensure that a
	 * later IORING_OP_MSG_RING delivers the message.
	 */
	if (!io_post_aux_cqe(target_ctx, msg->user_data, msg->len, 0))
		ret = -EOVERFLOW;
out_unlock:
	io_double_unlock_ctx(target_ctx, issue_flags);
	return ret;
}

static void io_msg_tw_fd_complete(struct callback_head *head)
{
	struct io_msg *msg = container_of(head, struct io_msg, tw);
	struct io_kiocb *req = cmd_to_io_kiocb(msg);
	int ret = -EOWNERDEAD;

	if (!(current->flags & PF_EXITING))
		ret = io_msg_install_complete(req, IO_URING_F_UNLOCKED);
	if (ret < 0)
		req_set_fail(req);
	io_req_queue_tw_complete(req, ret);
}

static int io_msg_send_fd(struct io_kiocb *req, unsigned int issue_flags)
{
	struct io_ring_ctx *target_ctx = req->file->private_data;
	struct io_msg *msg = io_kiocb_to_cmd(req, struct io_msg);
	struct io_ring_ctx *ctx = req->ctx;
	struct file *src_file = msg->src_file;

	if (target_ctx == ctx)
		return -EINVAL;
	if (!src_file) {
		src_file = io_msg_grab_file(req, issue_flags);
		if (!src_file)
			return -EBADF;
		msg->src_file = src_file;
		req->flags |= REQ_F_NEED_CLEANUP;
	}

	if (target_ctx->task_complete && current != target_ctx->submitter_task) {
		init_task_work(&msg->tw, io_msg_tw_fd_complete);
		if (task_work_add(target_ctx->submitter_task, &msg->tw,
				  TWA_SIGNAL))
			return -EOWNERDEAD;

		return IOU_ISSUE_SKIP_COMPLETE;
	}
	return io_msg_install_complete(req, issue_flags);
}

int io_msg_ring_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
{
	struct io_msg *msg = io_kiocb_to_cmd(req, struct io_msg);

	if (unlikely(sqe->buf_index || sqe->personality))
		return -EINVAL;

	msg->src_file = NULL;
	msg->user_data = READ_ONCE(sqe->off);
	msg->len = READ_ONCE(sqe->len);
	msg->cmd = READ_ONCE(sqe->addr);
	msg->src_fd = READ_ONCE(sqe->addr3);
	msg->dst_fd = READ_ONCE(sqe->file_index);
	msg->flags = READ_ONCE(sqe->msg_ring_flags);
	if (msg->flags & ~IORING_MSG_RING_CQE_SKIP)
		return -EINVAL;

	return 0;
}

int io_msg_ring(struct io_kiocb *req, unsigned int issue_flags)
{
	struct io_msg *msg = io_kiocb_to_cmd(req, struct io_msg);
	int ret;

	ret = -EBADFD;
	if (!io_is_uring_fops(req->file))
		goto done;

	switch (msg->cmd) {
	case IORING_MSG_DATA:
		ret = io_msg_ring_data(req);
		break;
	case IORING_MSG_SEND_FD:
		ret = io_msg_send_fd(req, issue_flags);
		break;
	default:
		ret = -EINVAL;
		break;
	}

done:
	if (ret < 0) {
		if (ret == -EAGAIN || ret == IOU_ISSUE_SKIP_COMPLETE)
			return ret;
		req_set_fail(req);
	}
	io_req_set_res(req, ret, 0);
	return IOU_OK;
}
Commit	Line	Data
36404b09 JA	1	// SPDX-License-Identifier: GPL-2.0
	2	#include <linux/kernel.h>
	3	#include <linux/errno.h>
	4	#include <linux/file.h>
	5	#include <linux/slab.h>
e6130eba	6	#include <linux/nospec.h>
36404b09 JA	7	#include <linux/io_uring.h>
	8
	9	#include <uapi/linux/io_uring.h>
	10
36404b09	11	#include "io_uring.h"
e6130eba JA	12	#include "rsrc.h"
e6130eba JA	13	#include "filetable.h"
36404b09 JA	14	#include "msg_ring.h"
	15
	16	struct io_msg {
	17	struct file *file;
11373026	18	struct file *src_file;
6d043ee1	19	struct callback_head tw;
36404b09 JA	20	u64 user_data;
36404b09 JA	21	u32 len;
e6130eba JA	22	u32 cmd;
	23	u32 src_fd;
	24	u32 dst_fd;
	25	u32 flags;
36404b09 JA	26	};
36404b09 JA	27
11373026 PB	28	void io_msg_ring_cleanup(struct io_kiocb *req)
	29	{
	30	struct io_msg *msg = io_kiocb_to_cmd(req, struct io_msg);
	31
	32	if (WARN_ON_ONCE(!msg->src_file))
	33	return;
	34
	35	fput(msg->src_file);
	36	msg->src_file = NULL;
	37	}
	38
6d043ee1 PB	39	static void io_msg_tw_complete(struct callback_head *head)
	40	{
	41	struct io_msg *msg = container_of(head, struct io_msg, tw);
	42	struct io_kiocb *req = cmd_to_io_kiocb(msg);
	43	struct io_ring_ctx *target_ctx = req->file->private_data;
	44	int ret = 0;
	45
	46	if (current->flags & PF_EXITING)
	47	ret = -EOWNERDEAD;
	48	else if (!io_post_aux_cqe(target_ctx, msg->user_data, msg->len, 0))
	49	ret = -EOVERFLOW;
	50
	51	if (ret < 0)
	52	req_set_fail(req);
	53	io_req_queue_tw_complete(req, ret);
	54	}
	55
e6130eba JA	56	static int io_msg_ring_data(struct io_kiocb *req)
	57	{
	58	struct io_ring_ctx *target_ctx = req->file->private_data;
f2ccb5ae	59	struct io_msg *msg = io_kiocb_to_cmd(req, struct io_msg);
e6130eba JA	60
	61	if (msg->src_fd \|\| msg->dst_fd \|\| msg->flags)
	62	return -EINVAL;
	63
6d043ee1 PB	64	if (target_ctx->task_complete && current != target_ctx->submitter_task) {
	65	init_task_work(&msg->tw, io_msg_tw_complete);
	66	if (task_work_add(target_ctx->submitter_task, &msg->tw,
	67	TWA_SIGNAL_NO_IPI))
	68	return -EOWNERDEAD;
	69
761c61c1	70	atomic_or(IORING_SQ_TASKRUN, &target_ctx->rings->sq_flags);
6d043ee1 PB	71	return IOU_ISSUE_SKIP_COMPLETE;
	72	}
	73
b529c96a	74	if (io_post_aux_cqe(target_ctx, msg->user_data, msg->len, 0))
e6130eba JA	75	return 0;
	76
	77	return -EOVERFLOW;
	78	}
	79
11373026	80	static void io_double_unlock_ctx(struct io_ring_ctx *octx,
e6130eba JA	81	unsigned int issue_flags)
e6130eba JA	82	{
e6130eba JA	83	mutex_unlock(&octx->uring_lock);
	84	}
	85
11373026	86	static int io_double_lock_ctx(struct io_ring_ctx *octx,
e6130eba JA	87	unsigned int issue_flags)
	88	{
	89	/*
	90	* To ensure proper ordering between the two ctxs, we can only
	91	* attempt a trylock on the target. If that fails and we already have
	92	* the source ctx lock, punt to io-wq.
	93	*/
	94	if (!(issue_flags & IO_URING_F_UNLOCKED)) {
	95	if (!mutex_trylock(&octx->uring_lock))
	96	return -EAGAIN;
	97	return 0;
	98	}
11373026 PB	99	mutex_lock(&octx->uring_lock);
	100	return 0;
	101	}
e6130eba	102
11373026 PB	103	static struct file io_msg_grab_file(struct io_kiocb req, unsigned int issue_flags)
	104	{
	105	struct io_msg *msg = io_kiocb_to_cmd(req, struct io_msg);
	106	struct io_ring_ctx *ctx = req->ctx;
	107	struct file *file = NULL;
	108	unsigned long file_ptr;
	109	int idx = msg->src_fd;
	110
	111	io_ring_submit_lock(ctx, issue_flags);
	112	if (likely(idx < ctx->nr_user_files)) {
	113	idx = array_index_nospec(idx, ctx->nr_user_files);
	114	file_ptr = io_fixed_file_slot(&ctx->file_table, idx)->file_ptr;
	115	file = (struct file *) (file_ptr & FFS_MASK);
	116	if (file)
	117	get_file(file);
e6130eba	118	}
11373026 PB	119	io_ring_submit_unlock(ctx, issue_flags);
11373026 PB	120	return file;
e6130eba JA	121	}
e6130eba JA	122
17211310	123	static int io_msg_install_complete(struct io_kiocb *req, unsigned int issue_flags)
e6130eba JA	124	{
e6130eba JA	125	struct io_ring_ctx *target_ctx = req->file->private_data;
f2ccb5ae	126	struct io_msg *msg = io_kiocb_to_cmd(req, struct io_msg);
11373026	127	struct file *src_file = msg->src_file;
e6130eba JA	128	int ret;
e6130eba JA	129
11373026 PB	130	if (unlikely(io_double_lock_ctx(target_ctx, issue_flags)))
11373026 PB	131	return -EAGAIN;
e6130eba JA	132
e6130eba JA	133	ret = __io_fixed_fd_install(target_ctx, src_file, msg->dst_fd);
11373026	134	if (ret < 0)
e6130eba	135	goto out_unlock;
17211310	136
11373026 PB	137	msg->src_file = NULL;
11373026 PB	138	req->flags &= ~REQ_F_NEED_CLEANUP;
e6130eba JA	139
	140	if (msg->flags & IORING_MSG_RING_CQE_SKIP)
	141	goto out_unlock;
e6130eba JA	142	/*
	143	* If this fails, the target still received the file descriptor but
	144	* wasn't notified of the fact. This means that if this request
	145	* completes with -EOVERFLOW, then the sender must ensure that a
	146	* later IORING_OP_MSG_RING delivers the message.
	147	*/
b529c96a	148	if (!io_post_aux_cqe(target_ctx, msg->user_data, msg->len, 0))
e6130eba JA	149	ret = -EOVERFLOW;
e6130eba JA	150	out_unlock:
11373026	151	io_double_unlock_ctx(target_ctx, issue_flags);
e6130eba JA	152	return ret;
	153	}
	154
6d043ee1 PB	155	static void io_msg_tw_fd_complete(struct callback_head *head)
	156	{
	157	struct io_msg *msg = container_of(head, struct io_msg, tw);
	158	struct io_kiocb *req = cmd_to_io_kiocb(msg);
	159	int ret = -EOWNERDEAD;
	160
	161	if (!(current->flags & PF_EXITING))
	162	ret = io_msg_install_complete(req, IO_URING_F_UNLOCKED);
	163	if (ret < 0)
	164	req_set_fail(req);
	165	io_req_queue_tw_complete(req, ret);
	166	}
	167
17211310 PB	168	static int io_msg_send_fd(struct io_kiocb *req, unsigned int issue_flags)
	169	{
	170	struct io_ring_ctx *target_ctx = req->file->private_data;
	171	struct io_msg *msg = io_kiocb_to_cmd(req, struct io_msg);
	172	struct io_ring_ctx *ctx = req->ctx;
	173	struct file *src_file = msg->src_file;
	174
	175	if (target_ctx == ctx)
	176	return -EINVAL;
	177	if (!src_file) {
	178	src_file = io_msg_grab_file(req, issue_flags);
	179	if (!src_file)
	180	return -EBADF;
	181	msg->src_file = src_file;
	182	req->flags \|= REQ_F_NEED_CLEANUP;
	183	}
6d043ee1 PB	184
	185	if (target_ctx->task_complete && current != target_ctx->submitter_task) {
	186	init_task_work(&msg->tw, io_msg_tw_fd_complete);
	187	if (task_work_add(target_ctx->submitter_task, &msg->tw,
	188	TWA_SIGNAL))
	189	return -EOWNERDEAD;
	190
	191	return IOU_ISSUE_SKIP_COMPLETE;
	192	}
17211310 PB	193	return io_msg_install_complete(req, issue_flags);
	194	}
	195
36404b09 JA	196	int io_msg_ring_prep(struct io_kiocb req, const struct io_uring_sqe sqe)
36404b09 JA	197	{
f2ccb5ae	198	struct io_msg *msg = io_kiocb_to_cmd(req, struct io_msg);
36404b09	199
e6130eba	200	if (unlikely(sqe->buf_index \|\| sqe->personality))
36404b09 JA	201	return -EINVAL;
36404b09 JA	202
11373026	203	msg->src_file = NULL;
36404b09 JA	204	msg->user_data = READ_ONCE(sqe->off);
36404b09 JA	205	msg->len = READ_ONCE(sqe->len);
e6130eba JA	206	msg->cmd = READ_ONCE(sqe->addr);
	207	msg->src_fd = READ_ONCE(sqe->addr3);
	208	msg->dst_fd = READ_ONCE(sqe->file_index);
	209	msg->flags = READ_ONCE(sqe->msg_ring_flags);
	210	if (msg->flags & ~IORING_MSG_RING_CQE_SKIP)
	211	return -EINVAL;
	212
36404b09 JA	213	return 0;
	214	}
	215
	216	int io_msg_ring(struct io_kiocb *req, unsigned int issue_flags)
	217	{
f2ccb5ae	218	struct io_msg *msg = io_kiocb_to_cmd(req, struct io_msg);
36404b09 JA	219	int ret;
	220
	221	ret = -EBADFD;
	222	if (!io_is_uring_fops(req->file))
	223	goto done;
	224
e6130eba JA	225	switch (msg->cmd) {
	226	case IORING_MSG_DATA:
	227	ret = io_msg_ring_data(req);
	228	break;
	229	case IORING_MSG_SEND_FD:
	230	ret = io_msg_send_fd(req, issue_flags);
	231	break;
	232	default:
	233	ret = -EINVAL;
	234	break;
	235	}
36404b09 JA	236
36404b09 JA	237	done:
6d043ee1 PB	238	if (ret < 0) {
	239	if (ret == -EAGAIN \|\| ret == IOU_ISSUE_SKIP_COMPLETE)
	240	return ret;
36404b09	241	req_set_fail(req);
6d043ee1	242	}
36404b09	243	io_req_set_res(req, ret, 0);
36404b09 JA	244	return IOU_OK;
36404b09 JA	245	}