kernel/git/stable/linux-stable.git/io_uring, branch linux-6.18.y

io_uring/waitid: fix KCSAN warning on io_waitid->head

2026-09-14T11:36:18+00:00

[ Upstream commit b994ace83a2bc7699420f6a4c6b860c8da133159 ] Storing of the iw->head entry inside the wait_queue callback, or when removing a waitid item, really should use proper load/store acquire/release semantics, and KCSAN correctly warns of that. Ensure that they do so. Reported-by: syzbot+eb441775f4f948a0902f@syzkaller.appspotmail.com Fixes: a48c0cbf28c0 ("io_uring/waitid: have io_waitid_complete() remove wait queue entry") Signed-off-by: Jens Axboe Signed-off-by: Sasha Levin

io_uring/waitid: use io_waitid_remove_wq() consistently

2026-09-14T11:36:18+00:00

[ Upstream commit ab673c1bcaf20ac70352eeb6bf5b828462676693 ] Use it everywhere that the wait_queue_entry is removed from the head, and be a bit more cautious in zeroing out iw->head whenever the entry is removed from the list. Signed-off-by: Jens Axboe Stable-dep-of: b994ace83a2b ("io_uring/waitid: fix KCSAN warning on io_waitid->head") Signed-off-by: Sasha Levin

io_uring/waitid: avoid siginfo copy during ring teardown

2026-09-14T11:34:19+00:00

[ Upstream commit 2cf20c4e0f72d523b8673053e7120d092ff1f074 ] During ring teardown, io_ring_exit_work() cancels outstanding requests from a kworker with a NULL tctx. The waitid cancellation path eventually reaches io_waitid_finish(), which copies the stored siginfo to the userspace pointer supplied with the request. Ring-wide teardown does not run in the task context that submitted the request, so it must not access that task's userspace pointer. Depending on the address and mm state, the copy may fail with -EFAULT, but the uaccess itself is inappropriate from the teardown kworker. Use a no-copy cancellation callback when io_waitid_remove_all() is called without an owning task context. Complete the request with -ECANCELED while releasing the waitid state without touching siginfo. Keep the existing siginfo handling for explicit async cancellation and task-scoped cancellation. Fixes: f31ecf671ddc ("io_uring: add IORING_OP_WAITID support") Cc: stable@vger.kernel.org Signed-off-by: Hui Su Link: https://patch.msgid.link/20260818103336.1922818-3-sh_def@163.com Signed-off-by: Jens Axboe Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

io_uring/waitid: honor task_work cancellation

2026-09-14T11:34:19+00:00

[ Upstream commit 14572de82e5022899e5856008bc9cac97004a88c ] io_waitid_cb() may run through the fallback task_work path when task_work_add() can no longer queue work to the originating task. The fallback runs from a kworker and io_uring marks such task work as canceled through tw.cancel. io_waitid_cb() currently ignores tw.cancel and calls __do_wait(). waitid is task-context dependent: __do_wait() performs child lookup relative to current, and the retry path also uses current->signal->wait_chldexit. If the callback runs from the fallback kworker, current is therefore not the task that submitted the request. Honor tw.cancel before entering __do_wait(). Complete the request with -ECANCELED and skip the siginfo copy, since canceled task work may run without the submitting task's userspace execution context. Keep the existing siginfo handling for normal waitid completion and explicit cancellation. Fixes: f31ecf671ddc ("io_uring: add IORING_OP_WAITID support") Cc: stable@vger.kernel.org Signed-off-by: Hui Su Link: https://patch.msgid.link/20260818103336.1922818-2-sh_def@163.com Signed-off-by: Jens Axboe Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

io_uring: add wrapper type for io_req_tw_func_t arg

2026-09-14T11:34:19+00:00

[ Upstream commit c33e779aba6804778c1440192a8033a145ba588d ] In preparation for uring_cmd implementations to implement functions with the io_req_tw_func_t signature, introduce a wrapper struct io_tw_req to hide the struct io_kiocb * argument. The intention is for only the io_uring core to access the inner struct io_kiocb *. uring_cmd implementations should instead call a helper from io_uring/cmd.h to convert struct io_tw_req to struct io_uring_cmd *. Signed-off-by: Caleb Sander Mateos Signed-off-by: Jens Axboe Stable-dep-of: 14572de82e50 ("io_uring/waitid: honor task_work cancellation") Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

io_uring: only call io_should_terminate_tw() once for ctx

2026-09-14T11:34:19+00:00

[ Upstream commit 4531d165ee39edb315b42a4a43e29339fa068e51 ] io_fallback_req_func() calls io_should_terminate_tw() on each req's ctx. But since the reqs all come from the ctx's fallback_llist, req->ctx will be ctx for all of the reqs. Therefore, compute ts.cancel as io_should_terminate_tw(ctx) just once, outside the loop. Signed-off-by: Caleb Sander Mateos Signed-off-by: Jens Axboe Stable-dep-of: 14572de82e50 ("io_uring/waitid: honor task_work cancellation") Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

io_uring/waitid: have io_waitid_complete() remove wait queue entry

2026-09-14T11:34:18+00:00

[ Upstream commit a48c0cbf28c03f6c590a14ceb31bf6e619c2f6da ] Both callers of this need the entry potentially removed, so shift the removal into the completion side and kill it from the two callers. While at it, add a helper for removing the wait_queue_entry based on the passed in io_kiocb. Signed-off-by: Jens Axboe Stable-dep-of: 14572de82e50 ("io_uring/waitid: honor task_work cancellation") Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

io_uring: unify task_work cancelation checks

2026-09-14T11:34:17+00:00

[ Upstream commit 7be20254a743be4f02414b9d56cc3fe5f84e6500 ] Rather than do per-tw checking, which needs to dip into the task_struct for checking flags, do it upfront before running task_work. This places a 'cancel' member in io_tw_token_t, which is assigned before running task_work for that given ctx. This is both more efficient in doing it upfront rather than for every task_work, and it means that io_should_terminate_tw() can be made private in io_uring.c rather than need to be called by various callbacks of task_work. Signed-off-by: Jens Axboe Stable-dep-of: 14572de82e50 ("io_uring/waitid: honor task_work cancellation") Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

io_uring/query: cap user size passed to copy_struct_to_user

2026-09-07T15:22:52+00:00

commit ba77efee1b95b4ad7559b1cdbe7cd7fa36dca95b upstream. io_handle_query_entry() clamps hdr.size for the inbound copy_from_user() but keeps the original user value as usize. copy_struct_to_user() uses that usize and, when it is larger than the kernel result, clear_user()s the trailing bytes. As hdr.size is a __u32, a query can request nearly 4 GiB of zeroing, including on the error path where res_size stays 0. The interface is reachable without a ring via IORING_REGISTER_QUERY. Reject sizes larger than PAGE_SIZE, as recommended for copy_struct_* interfaces. Fixes: c265ae75f900 ("io_uring: introduce io_uring querying") Cc: stable@vger.kernel.org # 6.18+ Signed-off-by: Laxman Acharya Padhya Reviewed-by: Gabriel Krisman Bertazi Link: https://patch.msgid.link/20260821103317.91437-1-acharyalaxman8848@gmail.com Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman

io_uring: defer eventfd signaling when queued from a wakeup handler

2026-09-02T12:31:47+00:00

[ Upstream commit cd305ee3633a45fcf5f3a5d83f99f3cb77d87b6e ] io_req_local_work_add() signals the CQ ring eventfd inline when it is the one to push the first entry onto ->work_list. For DEFER_TASKRUN rings that add is frequently done from a waitqueue wakeup handler, where an arbitrary waitqueue lock is held. eventfd_signal_mask() only refuses to recurse when current->in_eventfd is set, but that bit is set by eventfd_signal_mask() itself. If the wake chain starts somewhere else, signal goes out inline and can feed back into epoll. Add IOU_F_TWQ_IN_WAKE, set it on the task_work add done from the three waitqueue callbacks, and use it to force io_eventfd_signal() down the existing call_rcu_hurry() deferral instead of signaling inline. Fixes: 21a091b970cd ("io_uring: signal registered eventfd to process deferred task work") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/20260813133843.2933127-1-4ncienth@gmail.com/ Signed-off-by: Jens Axboe [ Relocated the `io_req_local_work_add()` hunk into io_uring.c and kept 6.18's `ctx->has_evfd` and open-coded `io_pollfree_wake()` context due to missing tw.c split and `io_poll_remove_waitq()`. ] Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman