Skip to content

btrfs: fix io_uring encoded IO cleanup and compat - #1102

Open
blktests-ci[bot] wants to merge 7 commits into
linus-master_basefrom
series/1141322=>linus-master
Open

btrfs: fix io_uring encoded IO cleanup and compat#1102
blktests-ci[bot] wants to merge 7 commits into
linus-master_basefrom
series/1141322=>linus-master

Conversation

@blktests-ci

@blktests-ci blktests-ci Bot commented Aug 6, 2026

Copy link
Copy Markdown

Pull request for series with
subject: btrfs: fix io_uring encoded IO cleanup and compat
version: 2
url: https://patchwork.kernel.org/project/linux-block/list/?series=1141322

@blktests-ci

blktests-ci Bot commented Aug 6, 2026

Copy link
Copy Markdown
Author

Upstream branch: 0d83957
series: https://patchwork.kernel.org/project/linux-block/list/?series=1141322
version: 2

@blktests-ci
blktests-ci Bot force-pushed the linus-master_base branch 2 times, most recently from 612ae31 to 863d43a Compare August 9, 2026 07:24
@blktests-ci

blktests-ci Bot commented Aug 9, 2026

Copy link
Copy Markdown
Author

Upstream branch: 06cf618
series: https://patchwork.kernel.org/project/linux-block/list/?series=1141322
version: 2

@blktests-ci
blktests-ci Bot force-pushed the series/1141322=>linus-master branch from 48e07b0 to 5035938 Compare August 9, 2026 07:43
@blktests-ci
blktests-ci Bot force-pushed the linus-master_base branch from 863d43a to 29ac21d Compare August 10, 2026 22:28
Yang Xiuwei added 7 commits August 10, 2026 22:50
If all bios finish before btrfs_encoded_read_regular_fill_pages()
returns, it calls btrfs_uring_read_extent_endio() and previously
returned the I/O status.  A negative errno then made
btrfs_uring_read_extent() unlock and free while
btrfs_uring_read_finished() did the same again.

Return -EIOCBQUEUED so only the deferred path cleans up.

Reported-by: Yue Sun <samsun1006219@gmail.com>
Closes: https://lore.kernel.org/linux-btrfs/20260630091609.3414-1-samsun1006219@gmail.com/
Suggested-by: Jens Axboe <axboe@kernel.dk>
Fixes: 34310c4 ("btrfs: add io_uring command for encoded reads (ENCODED_READ ioctl)")
Signed-off-by: Yang Xiuwei <yangxiuwei@kylinos.cn>
After btrfs_uring_read_extent(), the caller always jumped to out_acct.
That skips kfree(data->iov), which is only correct for -EIOCBQUEUED
where the deferred path owns the iov. On failure, fall through to
out_free instead.

Fixes: 34310c4 ("btrfs: add io_uring command for encoded reads (ENCODED_READ ioctl)")
Signed-off-by: Yang Xiuwei <yangxiuwei@kylinos.cn>
__import_iovec() already takes an explicit compat flag for callers that
cannot rely on in_compat_syscall() (io_uring SQPOLL / io-wq).  Export
it so loadable btrfs can use it for uring encoded IO.

Signed-off-by: Yang Xiuwei <yangxiuwei@kylinos.cn>
The uring encoded paths select args32 from IO_URING_F_COMPAT, but then
call import_iovec() for the iovec array. import_iovec() keys off
in_compat_syscall(), which is false when first issued from SQPOLL or
io-wq, so a compat ring can misread the iovec list as native layout.

Pass the same IO_URING_F_COMPAT flag into __import_iovec() instead.

Fixes: 34310c4 ("btrfs: add io_uring command for encoded reads (ENCODED_READ ioctl)")
Fixes: e32dcdb ("btrfs: add io_uring interface for encoded writes")
Signed-off-by: Yang Xiuwei <yangxiuwei@kylinos.cn>
btrfs_uring_read_extent() runs only after btrfs_encoded_read() has
taken the inode shared lock and the extent lock.  On failure it used to
unlock in out_fail, and a pages-array allocation failure returned
-ENOMEM without unlocking at all.

Unlock in the caller instead, matching the copy_to_user() error path.
out_fail only frees the local priv/pages allocations, and the pages
array failure joins that path.

Fixes: 34310c4 ("btrfs: add io_uring command for encoded reads (ENCODED_READ ioctl)")
Suggested-by: Qu Wenruo <quwenruo.btrfs@gmx.com>
Signed-off-by: Yang Xiuwei <yangxiuwei@kylinos.cn>
Reviewed-by: Qu Wenruo <wqu@suse.com>
Returning -EAGAIN while leaving btrfs_uring_encoded_data in the cmd PDU
leaks if the request is cancelled or the ring exits before reissue.
io_uring does not free driver PDU allocations on cleanup.

Write: io_queue_sqe() always issues with IO_URING_F_NONBLOCK first, so
return -EAGAIN before allocating and free data on every exit.

Read: free on nowait -EAGAIN too; only -EIOCBQUEUED keeps the
allocation for btrfs_uring_read_finished().

Fixes: 34310c4 ("btrfs: add io_uring command for encoded reads (ENCODED_READ ioctl)")
Fixes: e32dcdb ("btrfs: add io_uring interface for encoded writes")
Signed-off-by: Yang Xiuwei <yangxiuwei@kylinos.cn>
After not keeping state across -EAGAIN, restoring bc->data on REISSUE is
dead.  Remove it, stop using the cmd PDU on the write path, and fold the
read -EAGAIN check into the existing error path.

Signed-off-by: Yang Xiuwei <yangxiuwei@kylinos.cn>
@blktests-ci

blktests-ci Bot commented Aug 10, 2026

Copy link
Copy Markdown
Author

Upstream branch: d58772d
series: https://patchwork.kernel.org/project/linux-block/list/?series=1141322
version: 2

@blktests-ci
blktests-ci Bot force-pushed the series/1141322=>linus-master branch from 5035938 to 9a011c5 Compare August 10, 2026 22:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants