io_uring[a] is aLinux kernelsystem call interface for storage deviceasynchronous I/O operations addressing performance issues with similar interfaces provided by functions likeread()/write() oraio_read()/aio_write() etc. foroperations on data accessed byfile descriptors.[2][3]: 2
It works by creating twocircular buffers, called "queue rings", to track the submission and completion of I/O requests, respectively. For storage devices, these are called the submission queue (SQ) and completion queue (CQ).[4] Keeping these buffers shared between the kernel and application helps to boost theI/O performance by eliminating the need to issue extra and expensive system calls to copy these buffers between the two.[2][4][5] According to the io_uring design paper, the SQ buffer is writable only by consumer applications, and the CQ buffer is writable only by the kernel.[2]: 3
eBPF can be combined with io_uring.[6]
The Linux kernel has supportedasynchronous I/O since version 2.5, but it was seen as difficult to use and inefficient.[7] This older API only supported certain nicheuse cases,[8] notably it only enables asynchronous operation when using the O_DIRECT flag and while accessing already allocated files. This prevents utilizing thepage cache, while also exposing the application to complex O_DIRECT semantics. Linux AIO also does not support sockets, so it cannot be used to multiplex network and disk I/O.[9]
The io_uring kernel interface was adopted in Linux kernel version 5.1 to resolve the deficiencies of Linux AIO.[2][5][10] The liburing library provides anAPI to interact with the kernel interface easily fromuserspace.[2]: 12
In June 2023, Google's security team reported that 60% of theexploits submitted to theirbug bounty program in 2022 were exploits of the Linux kernel's io_uring vulnerabilities. As a result,io_uring was disabled for apps inAndroid, and disabled entirely inChromeOS as well as Google servers.[11]Docker also consequently disabled io_uring from their defaultseccomp profile.[12]
{{cite web}}: CS1 maint: bot: original URL status unknown (link){{cite web}}: CS1 maint: bot: original URL status unknown (link)Blocking during io_submit on ext4, on buffered operations, network access, pipes, etc. Some operations are not well-represented by the AIO interface. With completely unsupported operations like buffered reads, operations on a socket or pipes, the entire operation will be performed during the io_submit syscall, with the completion available immediately for access with io_getevents. AIO access to a file on a filesystem like ext4 is partially supported: if a metadata read is required to look up the data block (ie if the metadata is not already in memory), then the io_submit call will block on the metadata read. Certain types of file-enlarging writes are completely unsupported and block for the entire duration of the operation.
60% of the submissions exploited the io_uring component of the Linux kernel
liburing source repositoryio_uring source directory in the Linux kernel repository
