Re: [PATCH V3] io_uring: uring_cmd: add multishot support

[Jens Axboe <axboe@kernel.dk>]

On 8/19/25 9:00 AM, Ming Lei wrote:
> @@ -251,6 +265,11 @@ int io_uring_cmd(struct io_kiocb *req, unsigned int issue_flags)
>  	}
>  
>  	ret = file->f_op->uring_cmd(ioucmd, issue_flags);
> +	if (ioucmd->flags & IORING_URING_CMD_MULTISHOT) {
> +		if (ret >= 0)
> +			return IOU_ISSUE_SKIP_COMPLETE;
> +		io_kbuf_recycle(req, issue_flags);
> +	}
>  	if (ret == -EAGAIN) {
>  		ioucmd->flags |= IORING_URING_CMD_REISSUE;
>  		return ret;

Final comment on this part... uring_cmd is unique in the sense that it'd
be the first potentially pollable file type that supports buffer
selection AND can return -EIOCBQUEUED. For non-pollable, the buffer
would get committed upfront. For pollable, we'd either finish and put it
within this same execution context, or we'd drop it entirely when
returning -EAGAIN.

So what happens if we get -EIOCBQUEUED with a selected buffer from
provided buffer ring, and someome malicious unregisters and frees the
buffer ring before that request completes?

-- 
Jens Axboe