Re: [PATCH v4 03/25] io_uring/kbuf: add support for kernel-managed buffer rings

[Christoph Hellwig <hch@infradead.org>]

On Fri, Jan 16, 2026 at 03:30:22PM -0800, Joanne Koong wrote:
> The implementation follows the same pattern as pbuf ring registration,
> reusing the validation and buffer list allocation helpers introduced in
> earlier refactoring. The IOBL_KERNEL_MANAGED flag marks buffer lists as
> kernel-managed for appropriate handling in the I/O path.

Do you have a man page or other documentation for the uapi somewhere?

> +int io_register_kmbuf_ring(struct io_ring_ctx *ctx, void __user *arg)
> +{
> +	struct io_uring_buf_reg reg;
> +	struct io_buffer_list *bl;
> +	int ret;
> +
> +	lockdep_assert_held(&ctx->uring_lock);
> +
> +	if (copy_from_user(&reg, arg, sizeof(reg)))
> +		return -EFAULT;
> +
> +	ret = io_validate_buf_reg(&reg, 0);
> +	if (ret)
> +		return ret;

Probably more a comment for patch 1, but wouldn't it make sense
to combine copy from user and vaidation into a single helper?

> +	ret = io_alloc_new_buffer_list(ctx, &reg, &bl);
> +	if (ret)
> +		return ret;

Return the buffer list from io_alloc_new_buffer_list or an ERR_PTR
to simplify this a bit?

> +	ret = io_setup_kmbuf_ring(ctx, bl, &reg);
> +	if (ret) {
> +		kfree(bl);
> +		return ret;
> +	}
> +
> +	bl->flags |= IOBL_KERNEL_MANAGED;

Should io_setup_kmbuf_ring set IOBL_KERNEL_MANAGED as it is the one
creating the kernel managed buffers?

> +{
> +	gfp_t gfp = GFP_KERNEL_ACCOUNT | __GFP_ZERO | __GFP_NOWARN;

Isn't this really a GFP_USER allocation and should account towardas the
callers memory cgroup limit?

> +	if (WARN_ON_ONCE(mr->pages || mr->ptr || mr->nr_pages))
> +		return -EFAULT;
> +
> +	if (WARN_ON_ONCE(!nr_bufs || !buf_size))
> +		return -EINVAL;
> +
> +	nr_pages = ((size_t)buf_size * nr_bufs) >> PAGE_SHIFT;
> +	if (nr_pages > UINT_MAX)
> +		return -E2BIG;

This looks overflow prone, and probably should use check_mul_overflow.