EFAULT if not respecting IORING_FEAT_SINGLE_MMAP under 6.10-rc1 about liburing HOT 10 CLOSED

Great! Updated:

https://git.kernel.dk/cgit/linux/commit/?h=io_uring-6.10&id=06fe9b1df1086b42718d632aa57e8f7cd1a66a21

Closing this one, it'll go into Linus's tree later this week, before 6.10-rc2. Thanks for the report, and for testing -rc kernels! Much better to find these kinds of things before they hit an actual release.

from liburing.

Was just poking at this based on your earlier tweet, this is what I see here too. liburing seems to be underestimating the memory required, or the kernel overestimating. I'll poke a bit and figure out what is going on.

from liburing.

The patch worked!

Sure, can use Lucas Mülling <[email protected]>

from liburing.

I think it's the Kernel, since I came to this by doing things by hand, without liburing.

from liburing.

You sure? Looks like liburing passing in a too small value here. For example, for 128 sq entries, which is 256 entries, liburing passes in 4096. But that covers only the CQEs themselves, not the shared ring space which is 64 bytes. So the kernel thinks it should be 4096+64, liburing thinks it's 4096.

from liburing.

Hmm maybe it is the kernel...

from liburing.

Not sure, weird that is works on previous kernels using the same ring size.

from liburing.

Agree, the most likely suspect is the kernel not honoring old userspace which still does separate mmap's rather than take advantage for the single mmap.

from liburing.

Try this:

diff --git a/io_uring/memmap.c b/io_uring/memmap.c
index 4785d6af5fee..e5f634a1218e 100644
--- a/io_uring/memmap.c
+++ b/io_uring/memmap.c
@@ -244,17 +244,20 @@ __cold int io_uring_mmap(struct file *file, struct vm_area_struct *vma)
 	struct io_ring_ctx *ctx = file->private_data;
 	size_t sz = vma->vm_end - vma->vm_start;
 	long offset = vma->vm_pgoff << PAGE_SHIFT;
+	unsigned int npages;
 	void *ptr;
 
 	ptr = io_uring_validate_mmap_request(file, vma->vm_pgoff, sz);
 	if (IS_ERR(ptr))
 		return PTR_ERR(ptr);
 
+	npages = ctx->n_ring_pages;
 	switch (offset & IORING_OFF_MMAP_MASK) {
 	case IORING_OFF_SQ_RING:
+		npages = min(npages, (sz + PAGE_SIZE - 1) >> PAGE_SHIFT);
+		fallthrough;
 	case IORING_OFF_CQ_RING:
-		return io_uring_mmap_pages(ctx, vma, ctx->ring_pages,
-						ctx->n_ring_pages);
+		return io_uring_mmap_pages(ctx, vma, ctx->ring_pages, npages);
 	case IORING_OFF_SQES:
 		return io_uring_mmap_pages(ctx, vma, ctx->sqe_pages,
 						ctx->n_sqe_pages);

from liburing.

Tweaked it a bit and pushed it here:

https://git.kernel.dk/cgit/linux/commit/?h=io_uring-6.10&id=6767af20a5ea99889a64ef90a7f22c23c7d0b962

I like to add a Reported-by: tag to the commits to attribute the person who reported the issue. If you don't mind that, please provide me with an identity and email that I can use for that, eg Name <[email protected]> that I can put in there. If you don't want.

from liburing.