Re: [PATCH v2 06/25] io_uring/kbuf: add buffer ring pinning/unpinning

[Joanne Koong <joannelkoong@gmail.com>]

On Thu, Dec 18, 2025 at 4:34 PM Joanne Koong <joannelkoong@gmail.com> wrote:
>
> Add kernel APIs to pin and unpin buffer rings, preventing userspace from
> unregistering a buffer ring while it is pinned by the kernel.
>
> This provides a mechanism for kernel subsystems to safely access buffer
> ring contents while ensuring the buffer ring remains valid. A pinned
> buffer ring cannot be unregistered until explicitly unpinned. On the
> userspace side, trying to unregister a pinned buffer will return -EBUSY.
>
> This is a preparatory change for upcoming fuse usage of kernel-managed
> buffer rings. It is necessary for fuse to pin the buffer ring because
> fuse may need to select a buffer in atomic contexts, which it can only
> do so by using the underlying buffer list pointer.
>
> Signed-off-by: Joanne Koong <joannelkoong@gmail.com>
> ---
>  include/linux/io_uring/cmd.h | 17 +++++++++++++
>  io_uring/kbuf.c              | 48 ++++++++++++++++++++++++++++++++++++
>  io_uring/kbuf.h              | 10 ++++++++
>  io_uring/uring_cmd.c         | 18 ++++++++++++++
>  4 files changed, 93 insertions(+)
>
> diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c
> index c98cecb56b8c..49dc75f24432 100644
> --- a/io_uring/kbuf.c
> +++ b/io_uring/kbuf.c
> @@ -238,6 +238,52 @@ struct io_br_sel io_buffer_select(struct io_kiocb *req, size_t *len,
>         return sel;
>  }
>
> +int io_kbuf_ring_pin(struct io_kiocb *req, unsigned buf_group,
> +                    unsigned issue_flags, struct io_buffer_list **bl)
> +{
> +       struct io_buffer_list *buffer_list;
> +       struct io_ring_ctx *ctx = req->ctx;
> +       int ret = -EINVAL;
> +
> +       io_ring_submit_lock(ctx, issue_flags);
> +
> +       buffer_list = io_buffer_get_list(ctx, buf_group);
> +       if (likely(buffer_list) && likely(buffer_list->flags & IOBL_BUF_RING)) {
> +               if (unlikely(buffer_list->flags & IOBL_PINNED)) {
> +                       ret = -EALREADY;
> +               } else {
> +                       buffer_list->flags |= IOBL_PINNED;
> +                       ret = 0;
> +                       *bl = buffer_list;
> +               }
> +       }
> +
> +       io_ring_submit_unlock(ctx, issue_flags);
> +       return ret;
> +}
> +EXPORT_SYMBOL_GPL(io_kbuf_ring_pin);

This EXPORT_SYMBOL_GPL (and the one below) are remnants from v1 and
are no longer necessary. I"ll remove these for the next version.

> +
> +int io_kbuf_ring_unpin(struct io_kiocb *req, unsigned buf_group,
> +                      unsigned issue_flags)
> +{
> +       struct io_ring_ctx *ctx = req->ctx;
> +       struct io_buffer_list *bl;
> +       int ret = -EINVAL;
> +
> +       io_ring_submit_lock(ctx, issue_flags);
> +
> +       bl = io_buffer_get_list(ctx, buf_group);
> +       if (likely(bl) && likely(bl->flags & IOBL_BUF_RING) &&
> +           likely(bl->flags & IOBL_PINNED)) {
> +               bl->flags &= ~IOBL_PINNED;
> +               ret = 0;
> +       }
> +
> +       io_ring_submit_unlock(ctx, issue_flags);
> +       return ret;
> +}
> +EXPORT_SYMBOL_GPL(io_kbuf_ring_unpin);
> +