diff options
| author | Joanne Koong <joannelkoong@gmail.com> | 2025-12-04 15:54:50 -0800 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2025-12-05 09:52:02 -0700 |
| commit | a4c694bfc2455e82b7caf6045ca893d123e0ed11 (patch) | |
| tree | a2966e39c8205f2c96d24bcf09bce48ae7e1ba62 | |
| parent | 78385c7299f7514697d196b3233a91bd5e485591 (diff) | |
| download | tip-a4c694bfc2455e82b7caf6045ca893d123e0ed11.tar.gz | |
io_uring/kbuf: use WRITE_ONCE() for userspace-shared buffer ring fields
buf->addr and buf->len reside in memory shared with userspace. They
should be written with WRITE_ONCE() to guarantee atomic stores and
prevent tearing or other unsafe compiler optimizations.
Signed-off-by: Joanne Koong <joannelkoong@gmail.com>
Cc: Caleb Sander Mateos <csander@purestorage.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
| -rw-r--r-- | io_uring/kbuf.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c index 52b636d00a6b23..796d131107ddb9 100644 --- a/io_uring/kbuf.c +++ b/io_uring/kbuf.c @@ -44,11 +44,11 @@ static bool io_kbuf_inc_commit(struct io_buffer_list *bl, int len) buf_len -= this_len; /* Stop looping for invalid buffer length of 0 */ if (buf_len || !this_len) { - buf->addr = READ_ONCE(buf->addr) + this_len; - buf->len = buf_len; + WRITE_ONCE(buf->addr, READ_ONCE(buf->addr) + this_len); + WRITE_ONCE(buf->len, buf_len); return false; } - buf->len = 0; + WRITE_ONCE(buf->len, 0); bl->head++; len -= this_len; } @@ -291,7 +291,7 @@ static int io_ring_buffers_peek(struct io_kiocb *req, struct buf_sel_arg *arg, arg->partial_map = 1; if (iov != arg->iovs) break; - buf->len = len; + WRITE_ONCE(buf->len, len); } } |