Re: [RFC PATCH net-next 03/12] io_uring/opaque: add backing accounting and immutable versions

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Medium] io_uring/opaque: wake batch limit bypassed in
  io_opaque_wake_budget()
--

commit 330c6e48123376b4807cfeaa9a7e897d4c81a279
Author: Alex Markuze <amarkuze@redhat.com>

io_uring/opaque: add backing accounting and immutable versions

This commit adds backing-byte and extent accounting, immutable payload
version references, bvec/anchor vector building, and generation handle
lookup for io_uring opaque TCP payload objects.

> diff --git a/io_uring/opaque.c b/io_uring/opaque.c
> new file mode 100644
> index 0000000000000..2fd9db898e672
> --- /dev/null
> +++ b/io_uring/opaque.c
> @@ -0,0 +1,399 @@

[ ... ]

> +static bool io_opaque_wake_budget(struct io_opaque_store *store)
> +{
> +	struct io_opaque_req *op, *next;
> +	unsigned long delay = MAX_JIFFY_OFFSET;
> +	unsigned long now = jiffies;
> +	unsigned int woken = 0;
> +	bool stopped, more = false;
> +
> +	guard(spinlock)(&store->wait_lock);
> +	stopped = READ_ONCE(store->dead);
> +	list_for_each_entry_safe(op, next, &store->budget_waits, wait) {
> +		struct socket *sock = sock_from_file(op->req->file);
> +
> +		if (!stopped && !READ_ONCE(op->stream->closed)) {
> +			if (time_before(now, op->retry_at)) {
> +				delay = min(delay, op->retry_at - now);
> +				continue;
> +			}
> +			if (!io_opaque_budget_ready(op, now))
> +				continue;
> +			if (woken == IO_OPAQUE_WAKE_BATCH) {
> +				delay = 1;
> +				more = true;
> +				continue;
> +			}
> +		}
> +		list_del_init(&op->wait);
> +		/* A wake is not a reservation; the collector rechecks on entry. */
> +		woken++;

[Severity: Medium]
Can a closed-stream entry bypass the IO_OPAQUE_WAKE_BATCH limit here?

Once woken reaches IO_OPAQUE_WAKE_BATCH, any later entry on
store->budget_waits with op->stream->closed set skips the conditional block
and increments woken to IO_OPAQUE_WAKE_BATCH + 1.  For all subsequent open,
budget-ready waiters on the list, woken == IO_OPAQUE_WAKE_BATCH is then
false, so they are all woken under a single store->wait_lock hold instead of
being deferred with woken >= IO_OPAQUE_WAKE_BATCH.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261110132006.3280986-1-amarkuze@redhat.com?part=3