Gh0st
/
linux
mirror of https://github.com/torvalds/linux.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

io_uring: fix mixed cqe overflow handling 

I started to see zcrx data corruptions. That turned out to be due
to CQ tail pointing to a stale entry which happened to be from
a zcrx request. I.e. the tail is incremented without the CQE
memory being changed.

The culprit is __io_cqring_overflow_flush() passing "cqe32=true"
to io_get_cqe_overflow() for non-mixed CQE32 setups, which only
expects it to be set for mixed 32B CQEs and not for SETUP_CQE32.

The fix is slightly hacky, long term it's better to unify mixed and
CQE32 handling.

Fixes: e26dca67fd ("io_uring: add support for IORING_SETUP_CQE_MIXED")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
This commit is contained in:
Pavel Begunkov 2025-11-25 12:33:06 +00:00 committed by Jens Axboe
parent f6041803a8
commit f6dc5a3619
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
io_uring/io_uring.c
View File

@ -634,6 +634,8 @@ static void __io_cqring_overflow_flush(struct io_ring_ctx *ctx, bool dying)
is_cqe32 = true; is_cqe32 = true;
cqe_size <<= 1; cqe_size <<= 1;
} }
if (ctx->flags & IORING_SETUP_CQE32)
is_cqe32 = false;
if (!dying) { if (!dying) {
if (!io_get_cqe_overflow(ctx, &cqe, true, is_cqe32)) if (!io_get_cqe_overflow(ctx, &cqe, true, is_cqe32))