Re: [PATCH v1 14/30] io_uring: add release callback for ring death

[Caleb Sander Mateos <csander@purestorage.com>]

On Tue, Dec 2, 2025 at 4:36 PM Joanne Koong <joannelkoong@gmail.com> wrote:
>
> Allow registering a release callback on a ring context that will be
> called when the ring is about to be destroyed.
>
> This is a preparatory patch for fuse. Fuse will be pinning buffers and
> registering bvecs, which requires cleanup whenever a server
> disconnects. It needs to know if the ring is alive when the server has
> disconnected, to avoid double-freeing or accessing invalid memory.
>
> Signed-off-by: Joanne Koong <joannelkoong@gmail.com>
> ---
>  include/linux/io_uring.h       |  9 +++++++++
>  include/linux/io_uring_types.h |  2 ++
>  io_uring/io_uring.c            | 15 +++++++++++++++
>  3 files changed, 26 insertions(+)
>
> diff --git a/include/linux/io_uring.h b/include/linux/io_uring.h
> index 85fe4e6b275c..327fd8ac6e42 100644
> --- a/include/linux/io_uring.h
> +++ b/include/linux/io_uring.h
> @@ -2,6 +2,7 @@
>  #ifndef _LINUX_IO_URING_H
>  #define _LINUX_IO_URING_H
>
> +#include <linux/io_uring_types.h>
>  #include <linux/sched.h>
>  #include <linux/xarray.h>
>  #include <uapi/linux/io_uring.h>
> @@ -28,6 +29,9 @@ static inline void io_uring_free(struct task_struct *tsk)
>         if (tsk->io_uring)
>                 __io_uring_free(tsk);
>  }
> +void io_uring_set_release_callback(struct io_ring_ctx *ctx,
> +                                  void (*release)(void *), void *priv,
> +                                  unsigned int issue_flags);
>  #else
>  static inline void io_uring_task_cancel(void)
>  {
> @@ -46,6 +50,11 @@ static inline bool io_is_uring_fops(struct file *file)
>  {
>         return false;
>  }
> +static inline void
> +io_uring_set_release_callback(struct io_ring_ctx *ctx, void (*release)(void *),
> +                             void *priv, unsigned int issue_flags)
> +{
> +}
>  #endif
>
>  #endif
> diff --git a/include/linux/io_uring_types.h b/include/linux/io_uring_types.h
> index dcc95e73f12f..67c66658e3ec 100644
> --- a/include/linux/io_uring_types.h
> +++ b/include/linux/io_uring_types.h
> @@ -441,6 +441,8 @@ struct io_ring_ctx {
>         struct work_struct              exit_work;
>         struct list_head                tctx_list;
>         struct completion               ref_comp;
> +       void                            (*release)(void *);
> +       void                            *priv;
>
>         /* io-wq management, e.g. thread count */
>         u32                             iowq_limits[2];
> diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
> index 1e58fc1d5667..04ffcfa6f2d6 100644
> --- a/io_uring/io_uring.c
> +++ b/io_uring/io_uring.c
> @@ -2952,6 +2952,19 @@ static __poll_t io_uring_poll(struct file *file, poll_table *wait)
>         return mask;
>  }
>
> +void io_uring_set_release_callback(struct io_ring_ctx *ctx,
> +                                  void (*release)(void *), void *priv,
> +                                  unsigned int issue_flags)
> +{
> +       io_ring_submit_lock(ctx, issue_flags);
> +
> +       ctx->release = release;
> +       ctx->priv = priv;

Looks like this doesn't support the registration of multiple release
callbacks. Should there be a WARN_ON() to that effect?

Best,
Caleb

> +
> +       io_ring_submit_unlock(ctx, issue_flags);
> +}
> +EXPORT_SYMBOL_GPL(io_uring_set_release_callback);
> +
>  struct io_tctx_exit {
>         struct callback_head            task_work;
>         struct completion               completion;
> @@ -3099,6 +3112,8 @@ static int io_uring_release(struct inode *inode, struct file *file)
>         struct io_ring_ctx *ctx = file->private_data;
>
>         file->private_data = NULL;
> +       if (ctx->release)
> +               ctx->release(ctx->priv);
>         io_ring_ctx_wait_and_kill(ctx);
>         return 0;
>  }
> --
> 2.47.3
>