Re: [PATCH v4 0/3] io_uring: add splice(2) support

From: Jens Axboe <axboe@kernel.dk>
To: Pavel Begunkov <asml.silence@gmail.com>,
	Alexander Viro <viro@zeniv.linux.org.uk>,
	Stefan Metzmacher <metze@samba.org>,
	io-uring@vger.kernel.org, linux-fsdevel@vger.kernel.org,
	linux-kernel@vger.kernel.org
Subject: Re: [PATCH v4 0/3] io_uring: add splice(2) support
Date: Mon, 24 Feb 2020 15:34:30 -0700	[thread overview]
Message-ID: <596e6b61-e9de-7498-05c4-571613673c15@kernel.dk> (raw)
In-Reply-To: <923cc84a-e11f-2a16-2f12-ca3ba2f3ade4@kernel.dk>

On 2/24/20 8:35 AM, Jens Axboe wrote:
> On 2/24/20 1:32 AM, Pavel Begunkov wrote:
>> *on top of for-5.6 + async patches*
>>
>> Not the fastets implementation, but I'd need to stir up/duplicate
>> splice.c bits to do it more efficiently.
>>
>> note: rebase on top of the recent inflight patchset.
> 
> Let's get this queued up, looks good to go to me. Do you have a few
> liburing test cases we can add for this?

Seems to me like we have an address space issue for the off_in and
off_out parameters. Why aren't we passing in pointers to these
and making them work like regular splice?

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 792ef01a521c..b0cfd68be8c9 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -448,8 +448,8 @@ struct io_epoll {
 struct io_splice {
 	struct file			*file_out;
 	struct file			*file_in;
-	loff_t				off_out;
-	loff_t				off_in;
+	loff_t __user			*off_out;
+	loff_t __user			*off_in;
 	u64				len;
 	unsigned int			flags;
 };
@@ -2578,8 +2578,8 @@ static int io_splice_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
 		return 0;
 
 	sp->file_in = NULL;
-	sp->off_in = READ_ONCE(sqe->splice_off_in);
-	sp->off_out = READ_ONCE(sqe->off);
+	sp->off_in = u64_to_user_ptr(READ_ONCE(sqe->splice_off_in));
+	sp->off_out = u64_to_user_ptr(READ_ONCE(sqe->off));
 	sp->len = READ_ONCE(sqe->len);
 	sp->flags = READ_ONCE(sqe->splice_flags);
 
@@ -2614,7 +2614,6 @@ static int io_splice(struct io_kiocb *req, struct io_kiocb **nxt,
 	struct file *in = sp->file_in;
 	struct file *out = sp->file_out;
 	unsigned int flags = sp->flags & ~SPLICE_F_FD_IN_FIXED;
-	loff_t *poff_in, *poff_out;
 	long ret;
 
 	if (force_nonblock) {
@@ -2623,9 +2622,7 @@ static int io_splice(struct io_kiocb *req, struct io_kiocb **nxt,
 		flags |= SPLICE_F_NONBLOCK;
 	}
 
-	poff_in = (sp->off_in == -1) ? NULL : &sp->off_in;
-	poff_out = (sp->off_out == -1) ? NULL : &sp->off_out;
-	ret = do_splice(in, poff_in, out, poff_out, sp->len, flags);
+	ret = do_splice(in, sp->off_in, out, sp->off_out, sp->len, flags);
 	if (force_nonblock && ret == -EAGAIN)
 		return -EAGAIN;
 
-- 
Jens Axboe

