[PATCH 1/1] io_uring: fix rsrc tagging on registration failure

[PATCH 1/1] io_uring: fix rsrc tagging on registration failure

[Pavel Begunkov]

Buffer / file table registration is all or nothing, if fails all
resources we might have partially registered are dropped and the table
is killed. When that happens it doesn't suppose to post any rsrc tag
CQEs, that would be a surprise to the user and it can't be handled.

Cc: stable@vger.kernel.org
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
---
 io_uring/rsrc.c | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c
index 5e64a8bb30a4..b36c8825550e 100644
--- a/io_uring/rsrc.c
+++ b/io_uring/rsrc.c
@@ -175,6 +175,18 @@ void io_rsrc_cache_free(struct io_ring_ctx *ctx)
 	io_alloc_cache_free(&ctx->imu_cache, kfree);
 }
 
+static void io_clear_table_tags(struct io_rsrc_data *data)
+{
+	int i;
+
+	for (i = 0; i < data->nr; i++) {
+		struct io_rsrc_node *node = data->nodes[i];
+
+		if (node)
+			node->tag = 0;
+	}
+}
+
 __cold void io_rsrc_data_free(struct io_ring_ctx *ctx,
 			      struct io_rsrc_data *data)
 {
@@ -583,6 +595,7 @@ int io_sqe_files_register(struct io_ring_ctx *ctx, void __user *arg,
 	io_file_table_set_alloc_range(ctx, 0, ctx->file_table.data.nr);
 	return 0;
 fail:
+	io_clear_table_tags(&ctx->file_table.data);
 	io_sqe_files_unregister(ctx);
 	return ret;
 }
@@ -902,8 +915,10 @@ int io_sqe_buffers_register(struct io_ring_ctx *ctx, void __user *arg,
 	}
 
 	ctx->buf_table = data;
-	if (ret)
+	if (ret) {
+		io_clear_table_tags(&ctx->buf_table);
 		io_sqe_buffers_unregister(ctx);
+	}
 	return ret;
 }
 
-- 
2.48.1

Re: [PATCH 1/1] io_uring: fix rsrc tagging on registration failure

[Jens Axboe]

On 4/4/25 8:46 AM, Pavel Begunkov wrote:
> Buffer / file table registration is all or nothing, if fails all
> resources we might have partially registered are dropped and the table
> is killed. When that happens it doesn't suppose to post any rsrc tag
> CQEs, that would be a surprise to the user and it can't be handled.

Needs a bit of editing, but I can do that.

> Cc: stable@vger.kernel.org

We should either put a backport target on this, or a Fixes tag.
I guess a 6.1+ would suffice?

-- 
Jens Axboe

Re: [PATCH 1/1] io_uring: fix rsrc tagging on registration failure

[Pavel Begunkov]

On 4/4/25 15:55, Jens Axboe wrote:
> On 4/4/25 8:46 AM, Pavel Begunkov wrote:
>> Buffer / file table registration is all or nothing, if fails all
>> resources we might have partially registered are dropped and the table
>> is killed. When that happens it doesn't suppose to post any rsrc tag
>> CQEs, that would be a surprise to the user and it can't be handled.
> 
> Needs a bit of editing, but I can do that.
> 
>> Cc: stable@vger.kernel.org
> 
> We should either put a backport target on this, or a Fixes tag.
> I guess a 6.1+ would suffice?

Fixes: 7029acd8a9503 ("io_uring/rsrc: get rid of per-ring io_rsrc_node list")

Looks like this one. Recent enough, I thought I'd be worse.

-- 
Pavel Begunkov

Re: [PATCH 1/1] io_uring: fix rsrc tagging on registration failure

[Jens Axboe]

On 4/4/25 9:37 AM, Pavel Begunkov wrote:
> On 4/4/25 15:55, Jens Axboe wrote:
>> On 4/4/25 8:46 AM, Pavel Begunkov wrote:
>>> Buffer / file table registration is all or nothing, if fails all
>>> resources we might have partially registered are dropped and the table
>>> is killed. When that happens it doesn't suppose to post any rsrc tag
>>> CQEs, that would be a surprise to the user and it can't be handled.
>>
>> Needs a bit of editing, but I can do that.
>>
>>> Cc: stable@vger.kernel.org
>>
>> We should either put a backport target on this, or a Fixes tag.
>> I guess a 6.1+ would suffice?
> 
> Fixes: 7029acd8a9503 ("io_uring/rsrc: get rid of per-ring io_rsrc_node list")
> 
> Looks like this one. Recent enough, I thought I'd be worse.

Oh yeah, that's nice and simple then.

-- 
Jens Axboe

Re: [PATCH 1/1] io_uring: fix rsrc tagging on registration failure

[Jens Axboe]

On Fri, 04 Apr 2025 15:46:34 +0100, Pavel Begunkov wrote:
> Buffer / file table registration is all or nothing, if fails all
> resources we might have partially registered are dropped and the table
> is killed. When that happens it doesn't suppose to post any rsrc tag
> CQEs, that would be a surprise to the user and it can't be handled.
> 
> 

Applied, thanks!

[1/1] io_uring: fix rsrc tagging on registration failure
      commit: ab6005f3912fff07330297aba08922d2456dcede

Best regards,
-- 
Jens Axboe