diff options
| author | Nuoqi Gui <gnq25@mails.tsinghua.edu.cn> | 2026-09-04 12:41:55 +0200 |
|---|---|---|
| committer | Alexei Starovoitov <ast@kernel.org> | 2026-09-04 12:24:25 -0700 |
| commit | 2b97956af60810cd382b86b9ce9aea421b889861 (patch) | |
| tree | 7d9b0d8a91f77e63deff23976f68555a4895346a /io_uring/timeout.h | |
| download | linux-stable-2b97956af60810cd382b86b9ce9aea421b889861.tar.gz linux-stable-2b97956af60810cd382b86b9ce9aea421b889861.zip | |
selftests/bpf: Test rhtab kptr cancellation semanticsgrafted
Resizable hash-map updates and deletions must not perform full special-field
destruction in their caller context. In particular, a referenced kptr must
remain attached to the allocation until the memory allocator destructor can
release it safely.
Add separate coverage for both affected paths. The update test stores a task
kptr, replaces the ordinary value bytes with BPF_EXIST, and verifies that the
kptr survived. The delete test removes an element and exchanges its kptr
through the still-valid map-value pointer before the allocation is reclaimed.
Both cases observe a NULL kptr when rhtab uses bpf_obj_free_fields(). They
recover and release the reference after rhtab switches to cancellation
semantics.
Signed-off-by: Nuoqi Gui <gnq25@mails.tsinghua.edu.cn>
[ kkd: Split update and delete coverage and rewrote the commit log ]
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20260904104203.345917-5-memxor@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Diffstat (limited to 'io_uring/timeout.h')
| -rw-r--r-- | io_uring/timeout.h | 23 |
1 files changed, 23 insertions, 0 deletions
diff --git a/io_uring/timeout.h b/io_uring/timeout.h new file mode 100644 index 000000000..1620f94dd --- /dev/null +++ b/io_uring/timeout.h @@ -0,0 +1,23 @@ +// SPDX-License-Identifier: GPL-2.0 + +struct io_timeout_data { + struct io_kiocb *req; + struct hrtimer timer; + ktime_t time; + enum hrtimer_mode mode; + u32 flags; +}; + +__cold void io_flush_timeouts(struct io_ring_ctx *ctx); +struct io_cancel_data; +int io_timeout_cancel(struct io_ring_ctx *ctx, struct io_cancel_data *cd); +__cold bool io_kill_timeouts(struct io_ring_ctx *ctx, struct io_uring_task *tctx, + bool cancel_all); +void io_queue_linked_timeout(struct io_kiocb *req); +void io_disarm_next(struct io_kiocb *req); + +int io_timeout_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe); +int io_link_timeout_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe); +int io_timeout(struct io_kiocb *req, unsigned int issue_flags); +int io_timeout_remove_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe); +int io_timeout_remove(struct io_kiocb *req, unsigned int issue_flags); |