On Wed, Jul 29, 2026 at 7:37 PM Pavel Begunkov <[email protected]> wrote: > >> +static int io_import_dmabuf(struct io_kiocb *req, > >> + int ddir, struct iov_iter *iter, > >> + struct io_mapped_ubuf *imu, > >> + size_t len, size_t offset, > >> + unsigned issue_flags) > >> +{ > >> + struct io_regbuf_dma *db = imu->priv; > >> + struct dma_buf_io_map *map; > >> + > >> + if (!IS_ENABLED(CONFIG_DMA_SHARED_BUFFER)) > >> + return -EOPNOTSUPP; > >> + if (!len) > >> + return -EFAULT; > >> + if (req->file != db->target_file) > >> + return -EBADF; > >> + > >> + if (req->flags & REQ_F_DROP_DMABUF) { > >> + map = req->dmabuf_map; > >> + goto init_iter; > >> + } > > > > O_DIRECT is checked only during registration; we should recheck > > (file->f_flags & O_DIRECT) per request. > > Nobody should be able to clear O_DIRECT, unless I missed something? > And fwiw, io_uring wouldn't be the right place to do it. >
fcntl(fd, F_SETFL, flags & ~O_DIRECT) on an already registered, already open fd succeeds. The consequence is that subsequent I/Os switch to buffered I/O and cause silent data loss. Something on this path needs to reject this combination. > -- > Pavel Begunkov > >
