Merge tag 'vfs-6.10.rw' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull vfs rw iterator updates from Christian Brauner:
 "The core fs signalfd, userfaultfd, and timerfd subsystems did still
  use f_op->read() instead of f_op->read_iter(). Convert them over since
  we should aim to get rid of f_op->read() at some point.

  Aside from that io_uring and others want to mark files as FMODE_NOWAIT
  so it can make use of per-IO nonblocking hints to enable more
  efficient IO. Converting those users to f_op->read_iter() allows them
  to be marked with FMODE_NOWAIT"

* tag 'vfs-6.10.rw' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  signalfd: convert to ->read_iter()
  userfaultfd: convert to ->read_iter()
  timerfd: convert to ->read_iter()
  new helper: copy_to_iter_full()

diff --combined fs/userfaultfd.c
index 292f5fd501047f3af8d9a3af546c4e809f5d89bd,6d963402c8350468eac809aa8d40f35dc6f6f0de..2a564f813314300896b36fb2d5a48f9ae8eb38b9
--- 1/fs/userfaultfd.c
--- 2/fs/userfaultfd.c
+++ b/fs/userfaultfd.c
@@@ -31,6 -31,7 +31,7 @@@
  #include <linux/hugetlb.h>
  #include <linux/swapops.h>
  #include <linux/miscdevice.h>
+ #include <linux/uio.h>
  
  static int sysctl_unprivileged_userfaultfd __read_mostly;
  
@@@ -282,7 -283,7 +283,7 @@@ static inline bool userfaultfd_huge_mus
  /*
   * Verify the pagetables are still not ok after having reigstered into
   * the fault_pending_wqh to avoid userland having to UFFDIO_WAKE any
-  * userfault that has already been resolved, if userfaultfd_read and
+  * userfault that has already been resolved, if userfaultfd_read_iter and
   * UFFDIO_COPY|ZEROPAGE are being run simultaneously on two different
   * threads.
   */
@@@ -895,10 -896,6 +896,10 @@@ static int userfaultfd_release(struct i
                        prev = vma;
                        continue;
                }
 +              /* Reset ptes for the whole vma range if wr-protected */
 +              if (userfaultfd_wp(vma))
 +                      uffd_wp_range(vma, vma->vm_start,
 +                                    vma->vm_end - vma->vm_start, false);
                new_flags = vma->vm_flags & ~__VM_UFFD_FLAGS;
                vma = vma_modify_flags_uffd(&vmi, prev, vma, vma->vm_start,
                                            vma->vm_end, new_flags,
@@@ -1181,34 -1178,34 +1182,34 @@@ static ssize_t userfaultfd_ctx_read(str
        return ret;
  }
  
- static ssize_t userfaultfd_read(struct file *file, char __user *buf,
-                               size_t count, loff_t *ppos)
+ static ssize_t userfaultfd_read_iter(struct kiocb *iocb, struct iov_iter *to)
  {
+       struct file *file = iocb->ki_filp;
        struct userfaultfd_ctx *ctx = file->private_data;
        ssize_t _ret, ret = 0;
        struct uffd_msg msg;
-       int no_wait = file->f_flags & O_NONBLOCK;
        struct inode *inode = file_inode(file);
+       bool no_wait;
  
        if (!userfaultfd_is_initialized(ctx))
                return -EINVAL;
  
+       no_wait = file->f_flags & O_NONBLOCK || iocb->ki_flags & IOCB_NOWAIT;
        for (;;) {
-               if (count < sizeof(msg))
+               if (iov_iter_count(to) < sizeof(msg))
                        return ret ? ret : -EINVAL;
                _ret = userfaultfd_ctx_read(ctx, no_wait, &msg, inode);
                if (_ret < 0)
                        return ret ? ret : _ret;
-               if (copy_to_user((__u64 __user *) buf, &msg, sizeof(msg)))
+               _ret = !copy_to_iter_full(&msg, sizeof(msg), to);
+               if (_ret)
                        return ret ? ret : -EFAULT;
                ret += sizeof(msg);
-               buf += sizeof(msg);
-               count -= sizeof(msg);
                /*
                 * Allow to read more than one fault at time but only
                 * block if waiting for the very first one.
                 */
-               no_wait = O_NONBLOCK;
+               no_wait = true;
        }
  }
  
@@@ -2176,7 -2173,7 +2177,7 @@@ static const struct file_operations use
  #endif
        .release        = userfaultfd_release,
        .poll           = userfaultfd_poll,
-       .read           = userfaultfd_read,
+       .read_iter      = userfaultfd_read_iter,
        .unlocked_ioctl = userfaultfd_ioctl,
        .compat_ioctl   = compat_ptr_ioctl,
        .llseek         = noop_llseek,
@@@ -2196,6 -2193,7 +2197,7 @@@ static void init_once_userfaultfd_ctx(v
  static int new_userfaultfd(int flags)
  {
        struct userfaultfd_ctx *ctx;
+       struct file *file;
        int fd;
  
        BUG_ON(!current->mm);
@@@ -2219,16 -2217,26 +2221,26 @@@
        init_rwsem(&ctx->map_changing_lock);
        atomic_set(&ctx->mmap_changing, 0);
        ctx->mm = current->mm;
-       /* prevent the mm struct to be freed */
-       mmgrab(ctx->mm);
+ 
+       fd = get_unused_fd_flags(flags & UFFD_SHARED_FCNTL_FLAGS);
+       if (fd < 0)
+               goto err_out;
  
        /* Create a new inode so that the LSM can block the creation.  */
-       fd = anon_inode_create_getfd("[userfaultfd]", &userfaultfd_fops, ctx,
+       file = anon_inode_create_getfile("[userfaultfd]", &userfaultfd_fops, ctx,
                        O_RDONLY | (flags & UFFD_SHARED_FCNTL_FLAGS), NULL);
-       if (fd < 0) {
-               mmdrop(ctx->mm);
-               kmem_cache_free(userfaultfd_ctx_cachep, ctx);
+       if (IS_ERR(file)) {
+               put_unused_fd(fd);
+               fd = PTR_ERR(file);
+               goto err_out;
        }
+       /* prevent the mm struct to be freed */
+       mmgrab(ctx->mm);
+       file->f_mode |= FMODE_NOWAIT;
+       fd_install(fd, file);
+       return fd;
+ err_out:
+       kmem_cache_free(userfaultfd_ctx_cachep, ctx);
        return fd;
  }