Re: [PATCH for-next 1/1] io_uring/rsrc: don't mix different mappings in reg

[Pavel Begunkov <asml.silence@gmail.com>]

On 2/20/23 14:13, Pavel Begunkov wrote:
> If two or more mappings go back to back to each other they can be passed
> into io_uring to be registered as a single registered buffer. That would
> even work if mappings came from different sources, e.g. it's possible to
> mix in this way anon pages and pages from shmem or hugetlb. That is not
> a problem but it'd rather be less prone if we forbid such mixing.

The commit title got botched, let me rename and resend it.


> Cc: <stable@vger.kernel.org>
> Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
> ---
>   io_uring/rsrc.c | 15 ++++++++-------
>   1 file changed, 8 insertions(+), 7 deletions(-)
> 
> diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c
> index a59fc02de598..70d7f94670f9 100644
> --- a/io_uring/rsrc.c
> +++ b/io_uring/rsrc.c
> @@ -1162,18 +1162,19 @@ struct page **io_pin_pages(unsigned long ubuf, unsigned long len, int *npages)
>   	pret = pin_user_pages(ubuf, nr_pages, FOLL_WRITE | FOLL_LONGTERM,
>   			      pages, vmas);
>   	if (pret == nr_pages) {
> +		struct file *file = vmas[0]->vm_file;
> +
>   		/* don't support file backed memory */
>   		for (i = 0; i < nr_pages; i++) {
> -			struct vm_area_struct *vma = vmas[i];
> -
> -			if (vma_is_shmem(vma))
> +			if (vmas[i]->vm_file != file)
> +				break;
> +			if (!file)
>   				continue;
> -			if (vma->vm_file &&
> -			    !is_file_hugepages(vma->vm_file)) {
> -				ret = -EOPNOTSUPP;
> +			if (!vma_is_shmem(vmas[i]) && !is_file_hugepages(file))
>   				break;
> -			}
>   		}
> +		if (i != nr_pages)
> +			ret = -EOPNOTSUPP;
>   		*npages = nr_pages;
>   	} else {
>   		ret = pret < 0 ? pret : -EFAULT;

-- 
Pavel Begunkov