[SRU][N:linux-bluefield][PATCH v1 1/1] UBUNTU: SAUCE: io_uring/kbuf: fix inverted reserved-field checks

[Uri Dar]

BugLink: https://bugs.launchpad.net/bugs/2162843

The noble backport of upstream commit 1724849072854a ("io_uring/kbuf:
use mem_is_zero()") replaced the upstream

	if (!mem_is_zero(x, sizeof(x)))
		return -EINVAL;

with

	if (!memchr_inv(x, 0, sizeof(x)))
		return -EINVAL;

because mem_is_zero() did not exist in noble at that point. But
mem_is_zero() is itself defined as !memchr_inv(), so the equivalent of
!mem_is_zero() is memchr_inv() without the negation. As backported,
io_register_pbuf_ring(), io_unregister_pbuf_ring() and
io_register_pbuf_status() return -EINVAL whenever the reserved fields
are zero, i.e. for every correct caller, and accept requests whose
reserved fields are non-zero.

IORING_REGISTER_PBUF_RING has therefore been unusable since noble
6.8.0-136 (linux-bluefield 6.8.0-1028): liburing's
io_uring_register_buf_ring() and io_uring_setup_buf_ring() fail with
-EINVAL. On BlueField this breaks SPDK's uring sock module ("Failed to
create buffer ring").

Drop the negation so the checks match upstream again.

Issue: 5211347
Fixes: cff3ace786c7 ("io_uring/kbuf: use mem_is_zero()")
Signed-off-by: Uri Dar <udar at nvidia.com>
---
 io_uring/kbuf.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c
index 25cd4f012159..2564c453edc6 100644
--- a/io_uring/kbuf.c
+++ b/io_uring/kbuf.c
@@ -549,7 +549,7 @@ int io_register_pbuf_ring(struct io_ring_ctx *ctx, void __user *arg)
 
 	if (copy_from_user(&reg, arg, sizeof(reg)))
 		return -EFAULT;
-	if (!memchr_inv(reg.resv, 0, sizeof(reg.resv)))
+	if (memchr_inv(reg.resv, 0, sizeof(reg.resv)))
 		return -EINVAL;
 	if (reg.flags & ~IOU_PBUF_RING_MMAP)
 		return -EINVAL;
@@ -608,7 +608,7 @@ int io_unregister_pbuf_ring(struct io_ring_ctx *ctx, void __user *arg)
 
 	if (copy_from_user(&reg, arg, sizeof(reg)))
 		return -EFAULT;
-	if (!memchr_inv(reg.resv, 0, sizeof(reg.resv)) || reg.flags)
+	if (memchr_inv(reg.resv, 0, sizeof(reg.resv)) || reg.flags)
 		return -EINVAL;
 
 	bl = io_buffer_get_list(ctx, reg.bgid);
@@ -629,7 +629,7 @@ int io_register_pbuf_status(struct io_ring_ctx *ctx, void __user *arg)
 
 	if (copy_from_user(&buf_status, arg, sizeof(buf_status)))
 		return -EFAULT;
-	if (!memchr_inv(buf_status.resv, 0, sizeof(buf_status.resv)))
+	if (memchr_inv(buf_status.resv, 0, sizeof(buf_status.resv)))
 		return -EINVAL;
 
 	bl = io_buffer_get_list(ctx, buf_status.buf_group);
-- 
2.43.0