Files
Hengyu Liang b59cabf9b4 io_uring: do not charge the SQ/CQ rings to RLIMIT_MEMLOCK
Commit 8078486e1d ("io_uring: use region api for SQ") and commit
81a4058e0c ("io_uring: use region api for CQ") made io_uring_setup()
allocate the rings with io_create_region().

However, io_create_region() charges the memory to RLIMIT_MEMLOCK, and
the rings had been exempt from that limit since commit 26bfa89e25
("io_uring: place ring SQ/CQ arrays under memcg memory limits"). As of
now, a user without CAP_IPC_LOCK gets ENOMEM from io_uring_setup() when
their rings exceed the limit, which is 8 MiB by default. PostgreSQL
developers have already hit this in their io_uring tests [1].

The issue can be reproduced with a simple liburing program, run as an
unprivileged user:

    #include <liburing.h>
    #include <stdio.h>

    int main(void)
    {
            static struct io_uring ring[64];
            int i;

            for (i = 0; i < 64; i++)
                    if (io_uring_queue_init(4096, &ring[i], 0) < 0)
                            break;
            printf("%d rings\n", i);
            return 0;
    }

Before those commits (v6.13), it prints "64 rings". After those commits
(v6.14), it prints "21 rings".

This patch makes io_create_region() take the user to charge, and passes
no user for the SQ/CQ rings.

Link: https://www.postgresql.org/message-id/flat/[email protected] [1]
Fixes: 8078486e1d ("io_uring: use region api for SQ")
Fixes: 81a4058e0c ("io_uring: use region api for CQ")
Cc: [email protected]
Signed-off-by: Hengyu Liang <[email protected]>
Link: https://lore.kernel.org/io-uring/[email protected]/
Signed-off-by: Jens Axboe <[email protected]>
2026-10-08 13:07:38 -06:00

53 lines
1.5 KiB
C

/* SPDX-License-Identifier: GPL-2.0 */
#ifndef IO_URING_MEMMAP_H
#define IO_URING_MEMMAP_H
#define IORING_MAP_OFF_PARAM_REGION 0x20000000ULL
#define IORING_MAP_OFF_ZCRX_REGION 0x30000000ULL
#define IORING_OFF_ZCRX_SHIFT 16
struct page **io_pin_pages(unsigned long uaddr, unsigned long len, int *npages);
#ifndef CONFIG_MMU
unsigned int io_uring_nommu_mmap_capabilities(struct file *file);
#endif
unsigned long io_uring_get_unmapped_area(struct file *file, unsigned long addr,
unsigned long len, unsigned long pgoff,
unsigned long flags);
int io_uring_mmap(struct file *file, struct vm_area_struct *vma);
void io_free_region(struct user_struct *user, struct io_mapped_region *mr);
int io_create_region(struct user_struct *user, struct io_mapped_region *mr,
struct io_uring_region_desc *reg,
unsigned long mmap_offset);
static inline void *io_region_get_ptr(struct io_mapped_region *mr)
{
return mr->ptr;
}
static inline bool io_region_is_set(struct io_mapped_region *mr)
{
return !!mr->nr_pages;
}
static inline void io_region_publish(struct io_ring_ctx *ctx,
struct io_mapped_region *src_region,
struct io_mapped_region *dst_region)
{
/*
* Once published mmap can find it without holding only the ->mmap_lock
* and not ->uring_lock.
*/
guard(mutex)(&ctx->mmap_lock);
*dst_region = *src_region;
}
static inline size_t io_region_size(struct io_mapped_region *mr)
{
return (size_t) mr->nr_pages << PAGE_SHIFT;
}
#endif