Merge tag 'io_uring-5.9-2020-08-15' of git://git.kernel.dk/linux-block

Pull io_uring fixes from Jens Axboe:
 "A few differerent things in here.

  Seems like syzbot got some more io_uring bits wired up, and we got a
  handful of reports and the associated fixes are in here.

  General fixes too, and a lot of them marked for stable.

  Lastly, a bit of fallout from the async buffered reads, where we now
  more easily trigger short reads. Some applications don't really like
  that, so the io_read() code now handles short reads internally, and
  got a cleanup along the way so that it's now easier to read (and
  documented). We're now passing tests that failed before"

* tag 'io_uring-5.9-2020-08-15' of git://git.kernel.dk/linux-block:
  io_uring: short circuit -EAGAIN for blocking read attempt
  io_uring: sanitize double poll handling
  io_uring: internally retry short reads
  io_uring: retain iov_iter state over io_read/io_write calls
  task_work: only grab task signal lock when needed
  io_uring: enable lookup of links holding inflight files
  io_uring: fail poll arm on queue proc failure
  io_uring: hold 'ctx' reference around task_work queue + execute
  fs: RWF_NOWAIT should imply IOCB_NOIO
  io_uring: defer file table grabbing request cleanup for locked requests
  io_uring: add missing REQ_F_COMP_LOCKED for nested requests
  io_uring: fix recursive completion locking on oveflow flush
  io_uring: use TWA_SIGNAL for task_work uncondtionally
  io_uring: account locked memory before potential error case
  io_uring: set ctx sq/cq entry count earlier
  io_uring: Fix NULL pointer dereference in loop_rw_iter()
  io_uring: add comments on how the async buffered read retry works
  io_uring: io_async_buf_func() need not test page bit

diff --combined include/linux/fs.h
index 7c69dd7c61601652ec65f1703fecc9c34c2c03ed,f1cca4bfdd7baf0bccdb19f5fc021d0ec65e48ba..e019ea2f1347e6ebddea6cfeab01047c6af00660
--- 1/include/linux/fs.h
--- 2/include/linux/fs.h
+++ b/include/linux/fs.h
@@@ -518,16 -518,6 +518,16 @@@ static inline void i_mmap_unlock_read(s
        up_read(&mapping->i_mmap_rwsem);
  }
  
 +static inline void i_mmap_assert_locked(struct address_space *mapping)
 +{
 +      lockdep_assert_held(&mapping->i_mmap_rwsem);
 +}
 +
 +static inline void i_mmap_assert_write_locked(struct address_space *mapping)
 +{
 +      lockdep_assert_held_write(&mapping->i_mmap_rwsem);
 +}
 +
  /*
   * Might pages of this file be mapped into userspace?
   */
@@@ -538,7 -528,7 +538,7 @@@ static inline int mapping_mapped(struc
  
  /*
   * Might pages of this file have been modified in userspace?
 - * Note that i_mmap_writable counts all VM_SHARED vmas: do_mmap_pgoff
 + * Note that i_mmap_writable counts all VM_SHARED vmas: do_mmap
   * marks vma as VM_SHARED if it is shared, and the file was opened for
   * writing i.e. vma may be mprotected writable even if now readonly.
   *
@@@ -1722,10 -1712,6 +1722,10 @@@ int vfs_mkobj(struct dentry *, umode_t
                int (*f)(struct dentry *, umode_t, void *),
                void *);
  
 +int vfs_fchown(struct file *file, uid_t user, gid_t group);
 +int vfs_fchmod(struct file *file, umode_t mode);
 +int vfs_utimes(const struct path *path, struct timespec64 *times);
 +
  extern long vfs_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
  
  #ifdef CONFIG_COMPAT
@@@ -1956,27 -1942,27 +1956,27 @@@ struct super_operations 
  /*
   * Inode flags - they have no relation to superblock flags now
   */
 -#define S_SYNC                1       /* Writes are synced at once */
 -#define S_NOATIME     2       /* Do not update access times */
 -#define S_APPEND      4       /* Append-only file */
 -#define S_IMMUTABLE   8       /* Immutable file */
 -#define S_DEAD                16      /* removed, but still open directory */
 -#define S_NOQUOTA     32      /* Inode is not counted to quota */
 -#define S_DIRSYNC     64      /* Directory modifications are synchronous */
 -#define S_NOCMTIME    128     /* Do not update file c/mtime */
 -#define S_SWAPFILE    256     /* Do not truncate: swapon got its bmaps */
 -#define S_PRIVATE     512     /* Inode is fs-internal */
 -#define S_IMA         1024    /* Inode has an associated IMA struct */
 -#define S_AUTOMOUNT   2048    /* Automount/referral quasi-directory */
 -#define S_NOSEC               4096    /* no suid or xattr security attributes */
 +#define S_SYNC                (1 << 0)  /* Writes are synced at once */
 +#define S_NOATIME     (1 << 1)  /* Do not update access times */
 +#define S_APPEND      (1 << 2)  /* Append-only file */
 +#define S_IMMUTABLE   (1 << 3)  /* Immutable file */
 +#define S_DEAD                (1 << 4)  /* removed, but still open directory */
 +#define S_NOQUOTA     (1 << 5)  /* Inode is not counted to quota */
 +#define S_DIRSYNC     (1 << 6)  /* Directory modifications are synchronous */
 +#define S_NOCMTIME    (1 << 7)  /* Do not update file c/mtime */
 +#define S_SWAPFILE    (1 << 8)  /* Do not truncate: swapon got its bmaps */
 +#define S_PRIVATE     (1 << 9)  /* Inode is fs-internal */
 +#define S_IMA         (1 << 10) /* Inode has an associated IMA struct */
 +#define S_AUTOMOUNT   (1 << 11) /* Automount/referral quasi-directory */
 +#define S_NOSEC               (1 << 12) /* no suid or xattr security attributes */
  #ifdef CONFIG_FS_DAX
 -#define S_DAX         8192    /* Direct Access, avoiding the page cache */
 +#define S_DAX         (1 << 13) /* Direct Access, avoiding the page cache */
  #else
 -#define S_DAX         0       /* Make all the DAX code disappear */
 +#define S_DAX         0         /* Make all the DAX code disappear */
  #endif
 -#define S_ENCRYPTED   16384   /* Encrypted file (using fs/crypto/) */
 -#define S_CASEFOLD    32768   /* Casefolded file */
 -#define S_VERITY      65536   /* Verity file (using fs/verity/) */
 +#define S_ENCRYPTED   (1 << 14) /* Encrypted file (using fs/crypto/) */
 +#define S_CASEFOLD    (1 << 15) /* Casefolded file */
 +#define S_VERITY      (1 << 16) /* Verity file (using fs/verity/) */
  
  /*
   * Note that nosuid etc flags are inode-specific: setting some file-system
@@@ -2660,7 -2646,7 +2660,7 @@@ static inline void filemap_set_wb_err(s
  }
  
  /**
 - * filemap_check_wb_error - has an error occurred since the mark was sampled?
 + * filemap_check_wb_err - has an error occurred since the mark was sampled?
   * @mapping: mapping to check for writeback errors
   * @since: previously-sampled errseq_t
   *
@@@ -2689,7 -2675,7 +2689,7 @@@ static inline errseq_t filemap_sample_w
  
  /**
   * file_sample_sb_err - sample the current errseq_t to test for later errors
 - * @mapping: mapping to be sampled
 + * @file: file pointer to be sampled
   *
   * Grab the most current superblock-level errseq_t value for the given
   * struct file.
@@@ -2960,21 -2946,6 +2960,21 @@@ extern void discard_new_inode(struct in
  extern unsigned int get_next_ino(void);
  extern void evict_inodes(struct super_block *sb);
  
 +/*
 + * Userspace may rely on the the inode number being non-zero. For example, glibc
 + * simply ignores files with zero i_ino in unlink() and other places.
 + *
 + * As an additional complication, if userspace was compiled with
 + * _FILE_OFFSET_BITS=32 on a 64-bit kernel we'll only end up reading out the
 + * lower 32 bits, so we need to check that those aren't zero explicitly. With
 + * _FILE_OFFSET_BITS=64, this may cause some harmless false-negatives, but
 + * better safe than sorry.
 + */
 +static inline bool is_zero_ino(ino_t ino)
 +{
 +      return (u32)ino == 0;
 +}
 +
  extern void __iget(struct inode * inode);
  extern void iget_failed(struct inode *);
  extern void clear_inode(struct inode *);
@@@ -3322,7 -3293,7 +3322,7 @@@ static inline int kiocb_set_rw_flags(st
        if (flags & RWF_NOWAIT) {
                if (!(ki->ki_filp->f_mode & FMODE_NOWAIT))
                        return -EOPNOTSUPP;
-               kiocb_flags |= IOCB_NOWAIT;
+               kiocb_flags |= IOCB_NOWAIT | IOCB_NOIO;
        }
        if (flags & RWF_HIPRI)
                kiocb_flags |= IOCB_HIPRI;