Merge tag 'io_uring-7.3-20261002' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linuxgrafted

Pull io_uring fixes from Jens Axboe:

 - Fix a task_work add use-after-free with SQPOLL.

   The sqpoll thread could pop and complete the last request while
   io_req_normal_work_add() was still looking at them after the mpscq
   push.

   Use the same approach as DEFER_TASKRUN to protect from that, holding
   an RCU read lock across the add, and have exit wait for an RCU grace
   period for SQPOLL rings as well.

 - CQE32 ring fixes: correct the free entry check for 32b CQEs, zero the
   big_cqe for aux CQEs, and only post the dummy skip CQE on CQE_MIXED
   rings

 - Mark the source filter table as COW when cloning bpf filters, so
   registering another filter on the source doesn't modify the shared
   table in place

 - Initialize the task context before running the BPF loop

 - Requeue zcrx multishot receives stopped by a local resource

 - End a TX_TIMESTAMP multishot cmd when the CQ is full (lollipopkit)

* tag 'io_uring-7.3-20261002' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  io_uring: fix task_work add use-after-free with SQPOLL
  io_uring/cmd_net: end TX_TIMESTAMP multishot when the CQ is full
  io_uring/zcrx: requeue multishot receives stopped by a local resource
  io_uring: initialize task context before running the BPF loop
  io_uring: zero big_cqe for aux CQEs on CQE32 rings
  io_uring: fix free entry check for 32b CQEs on CQE32 rings
  io_uring: only post the dummy skip CQE on CQE_MIXED rings
  io_uring/bpf_filter: mark source as COW when cloning filters

1 files changed, 267 insertions, 0 deletions

diff --git a/rust/syn/scan_expr.rs b/rust/syn/scan_expr.rs
new file mode 100644
index 000000000..a5fd1ddc1
--- /dev/null
+++ b/rust/syn/scan_expr.rs
@@ -0,0 +1,267 @@
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+use self::{Action::*, Input::*};
+use proc_macro2::{Delimiter, Ident, Spacing, TokenTree};
+use syn::parse::{ParseStream, Result};
+use syn::{AngleBracketedGenericArguments, BinOp, Expr, ExprPath, Lifetime, Lit, Token, Type};
+
+enum Input {
+    Keyword(&'static str),
+    Punct(&'static str),
+    ConsumeAny,
+    ConsumeBinOp,
+    ConsumeBrace,
+    ConsumeDelimiter,
+    ConsumeIdent,
+    ConsumeLifetime,
+    ConsumeLiteral,
+    ConsumeNestedBrace,
+    ExpectPath,
+    ExpectTurbofish,
+    ExpectType,
+    CanBeginExpr,
+    Otherwise,
+    Empty,
+}
+
+enum Action {
+    SetState(&'static [(Input, Action)]),
+    IncDepth,
+    DecDepth,
+    Finish,
+}
+
+static INIT: [(Input, Action); 28] = [
+    (ConsumeDelimiter, SetState(&POSTFIX)),
+    (Keyword("async"), SetState(&ASYNC)),
+    (Keyword("break"), SetState(&BREAK_LABEL)),
+    (Keyword("const"), SetState(&CONST)),
+    (Keyword("continue"), SetState(&CONTINUE)),
+    (Keyword("for"), SetState(&FOR)),
+    (Keyword("if"), IncDepth),
+    (Keyword("let"), SetState(&PATTERN)),
+    (Keyword("loop"), SetState(&BLOCK)),
+    (Keyword("match"), IncDepth),
+    (Keyword("move"), SetState(&CLOSURE)),
+    (Keyword("return"), SetState(&RETURN)),
+    (Keyword("static"), SetState(&CLOSURE)),
+    (Keyword("unsafe"), SetState(&BLOCK)),
+    (Keyword("while"), IncDepth),
+    (Keyword("yield"), SetState(&RETURN)),
+    (Keyword("_"), SetState(&POSTFIX)),
+    (Punct("!"), SetState(&INIT)),
+    (Punct("#"), SetState(&[(ConsumeDelimiter, SetState(&INIT))])),
+    (Punct("&"), SetState(&REFERENCE)),
+    (Punct("*"), SetState(&INIT)),
+    (Punct("-"), SetState(&INIT)),
+    (Punct("..="), SetState(&INIT)),
+    (Punct(".."), SetState(&RANGE)),
+    (Punct("|"), SetState(&CLOSURE_ARGS)),
+    (ConsumeLifetime, SetState(&[(Punct(":"), SetState(&INIT))])),
+    (ConsumeLiteral, SetState(&POSTFIX)),
+    (ExpectPath, SetState(&PATH)),
+];
+
+static POSTFIX: [(Input, Action); 10] = [
+    (Keyword("as"), SetState(&[(ExpectType, SetState(&POSTFIX))])),
+    (Punct("..="), SetState(&INIT)),
+    (Punct(".."), SetState(&RANGE)),
+    (Punct("."), SetState(&DOT)),
+    (Punct("?"), SetState(&POSTFIX)),
+    (ConsumeBinOp, SetState(&INIT)),
+    (Punct("="), SetState(&INIT)),
+    (ConsumeNestedBrace, SetState(&IF_THEN)),
+    (ConsumeDelimiter, SetState(&POSTFIX)),
+    (Empty, Finish),
+];
+
+static ASYNC: [(Input, Action); 3] = [
+    (Keyword("move"), SetState(&ASYNC)),
+    (Punct("|"), SetState(&CLOSURE_ARGS)),
+    (ConsumeBrace, SetState(&POSTFIX)),
+];
+
+static BLOCK: [(Input, Action); 1] = [(ConsumeBrace, SetState(&POSTFIX))];
+
+static BREAK_LABEL: [(Input, Action); 2] = [
+    (ConsumeLifetime, SetState(&BREAK_VALUE)),
+    (Otherwise, SetState(&BREAK_VALUE)),
+];
+
+static BREAK_VALUE: [(Input, Action); 3] = [
+    (ConsumeNestedBrace, SetState(&IF_THEN)),
+    (CanBeginExpr, SetState(&INIT)),
+    (Otherwise, SetState(&POSTFIX)),
+];
+
+static CLOSURE: [(Input, Action); 7] = [
+    (Keyword("async"), SetState(&CLOSURE)),
+    (Keyword("move"), SetState(&CLOSURE)),
+    (Punct(","), SetState(&CLOSURE)),
+    (Punct(">"), SetState(&CLOSURE)),
+    (Punct("|"), SetState(&CLOSURE_ARGS)),
+    (ConsumeLifetime, SetState(&CLOSURE)),
+    (ConsumeIdent, SetState(&CLOSURE)),
+];
+
+static CLOSURE_ARGS: [(Input, Action); 2] = [
+    (Punct("|"), SetState(&CLOSURE_RET)),
+    (ConsumeAny, SetState(&CLOSURE_ARGS)),
+];
+
+static CLOSURE_RET: [(Input, Action); 2] = [
+    (Punct("->"), SetState(&[(ExpectType, SetState(&BLOCK))])),
+    (Otherwise, SetState(&INIT)),
+];
+
+static CONST: [(Input, Action); 2] = [
+    (Punct("|"), SetState(&CLOSURE_ARGS)),
+    (ConsumeBrace, SetState(&POSTFIX)),
+];
+
+static CONTINUE: [(Input, Action); 2] = [
+    (ConsumeLifetime, SetState(&POSTFIX)),
+    (Otherwise, SetState(&POSTFIX)),
+];
+
+static DOT: [(Input, Action); 3] = [
+    (Keyword("await"), SetState(&POSTFIX)),
+    (ConsumeIdent, SetState(&METHOD)),
+    (ConsumeLiteral, SetState(&POSTFIX)),
+];
+
+static FOR: [(Input, Action); 2] = [
+    (Punct("<"), SetState(&CLOSURE)),
+    (Otherwise, SetState(&PATTERN)),
+];
+
+static IF_ELSE: [(Input, Action); 2] = [(Keyword("if"), SetState(&INIT)), (ConsumeBrace, DecDepth)];
+static IF_THEN: [(Input, Action); 2] =
+    [(Keyword("else"), SetState(&IF_ELSE)), (Otherwise, DecDepth)];
+
+static METHOD: [(Input, Action); 1] = [(ExpectTurbofish, SetState(&POSTFIX))];
+
+static PATH: [(Input, Action); 4] = [
+    (Punct("!="), SetState(&INIT)),
+    (Punct("!"), SetState(&INIT)),
+    (ConsumeNestedBrace, SetState(&IF_THEN)),
+    (Otherwise, SetState(&POSTFIX)),
+];
+
+static PATTERN: [(Input, Action); 15] = [
+    (ConsumeDelimiter, SetState(&PATTERN)),
+    (Keyword("box"), SetState(&PATTERN)),
+    (Keyword("in"), IncDepth),
+    (Keyword("mut"), SetState(&PATTERN)),
+    (Keyword("ref"), SetState(&PATTERN)),
+    (Keyword("_"), SetState(&PATTERN)),
+    (Punct("!"), SetState(&PATTERN)),
+    (Punct("&"), SetState(&PATTERN)),
+    (Punct("..="), SetState(&PATTERN)),
+    (Punct(".."), SetState(&PATTERN)),
+    (Punct("="), SetState(&INIT)),
+    (Punct("@"), SetState(&PATTERN)),
+    (Punct("|"), SetState(&PATTERN)),
+    (ConsumeLiteral, SetState(&PATTERN)),
+    (ExpectPath, SetState(&PATTERN)),
+];
+
+static RANGE: [(Input, Action); 6] = [
+    (Punct("..="), SetState(&INIT)),
+    (Punct(".."), SetState(&RANGE)),
+    (Punct("."), SetState(&DOT)),
+    (ConsumeNestedBrace, SetState(&IF_THEN)),
+    (Empty, Finish),
+    (Otherwise, SetState(&INIT)),
+];
+
+static RAW: [(Input, Action); 3] = [
+    (Keyword("const"), SetState(&INIT)),
+    (Keyword("mut"), SetState(&INIT)),
+    (Otherwise, SetState(&POSTFIX)),
+];
+
+static REFERENCE: [(Input, Action); 3] = [
+    (Keyword("mut"), SetState(&INIT)),
+    (Keyword("raw"), SetState(&RAW)),
+    (Otherwise, SetState(&INIT)),
+];
+
+static RETURN: [(Input, Action); 2] = [
+    (CanBeginExpr, SetState(&INIT)),
+    (Otherwise, SetState(&POSTFIX)),
+];
+
+pub(crate) fn scan_expr(input: ParseStream) -> Result<()> {
+    let mut state = INIT.as_slice();
+    let mut depth = 0usize;
+    'table: loop {
+        for rule in state {
+            if match rule.0 {
+                Input::Keyword(expected) => input.step(|cursor| match cursor.ident() {
+                    Some((ident, rest)) if ident == expected => Ok((true, rest)),
+                    _ => Ok((false, *cursor)),
+                })?,
+                Input::Punct(expected) => input.step(|cursor| {
+                    let begin = *cursor;
+                    let mut cursor = begin;
+                    for (i, ch) in expected.chars().enumerate() {
+                        match cursor.punct() {
+                            Some((punct, _)) if punct.as_char() != ch => break,
+                            Some((_, rest)) if i == expected.len() - 1 => {
+                                return Ok((true, rest));
+                            }
+                            Some((punct, rest)) if punct.spacing() == Spacing::Joint => {
+                                cursor = rest;
+                            }
+                            _ => break,
+                        }
+                    }
+                    Ok((false, begin))
+                })?,
+                Input::ConsumeAny => input.parse::<Option<TokenTree>>()?.is_some(),
+                Input::ConsumeBinOp => input.parse::<BinOp>().is_ok(),
+                Input::ConsumeBrace | Input::ConsumeNestedBrace => {
+                    (matches!(rule.0, Input::ConsumeBrace) || depth > 0)
+                        && input.step(|cursor| match cursor.group(Delimiter::Brace) {
+                            Some((_inside, _span, rest)) => Ok((true, rest)),
+                            None => Ok((false, *cursor)),
+                        })?
+                }
+                Input::ConsumeDelimiter => input.step(|cursor| match cursor.any_group() {
+                    Some((_inside, _delimiter, _span, rest)) => Ok((true, rest)),
+                    None => Ok((false, *cursor)),
+                })?,
+                Input::ConsumeIdent => input.parse::<Option<Ident>>()?.is_some(),
+                Input::ConsumeLifetime => input.parse::<Option<Lifetime>>()?.is_some(),
+                Input::ConsumeLiteral => input.parse::<Option<Lit>>()?.is_some(),
+                Input::ExpectPath => {
+                    input.parse::<ExprPath>()?;
+                    true
+                }
+                Input::ExpectTurbofish => {
+                    if input.peek(Token![::]) {
+                        input.parse::<AngleBracketedGenericArguments>()?;
+                    }
+                    true
+                }
+                Input::ExpectType => {
+                    Type::without_plus(input)?;
+                    true
+                }
+                Input::CanBeginExpr => Expr::peek(input),
+                Input::Otherwise => true,
+                Input::Empty => input.is_empty() || input.peek(Token![,]),
+            } {
+                state = match rule.1 {
+                    Action::SetState(next) => next,
+                    Action::IncDepth => (depth += 1, &INIT).1,
+                    Action::DecDepth => (depth -= 1, &POSTFIX).1,
+                    Action::Finish => return if depth == 0 { Ok(()) } else { break },
+                };
+                continue 'table;
+            }
+        }
+        return Err(input.error("unsupported expression"));
+    }
+}