Commit 2f8229d5 authored Oct 07, 2025 by Jens Axboe

io_uring/waitid: always prune wait queue entry in io_waitid_wait()



For a successful return, always remove our entry from the wait queue
entry list. Previously this was skipped if a cancelation was in
progress, but this can race with another invocation of the wait queue
entry callback.

Cc: stable@vger.kernel.org
Fixes: f31ecf67 ("io_uring: add IORING_OP_WAITID support")
Reported-by:  <syzbot+b9e83021d9c642a33d8c@syzkaller.appspotmail.com>
Tested-by:  <syzbot+b9e83021d9c642a33d8c@syzkaller.appspotmail.com>
Link: https://lore.kernel.org/io-uring/68e5195e.050a0220.256323.001f.GAE@google.com/


Signed-off-by: Jens Axboe <axboe@kernel.dk>

parent 0ca28647

io_uring/waitid.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -230,13 +230,14 @@ static int io_waitid_wait(struct wait_queue_entry *wait, unsigned mode,
		if (!pid_child_should_wake(wo, p))
		return 0;

		list_del_init(&wait->entry);

		/* cancel is in progress */
		if (atomic_fetch_inc(&iw->refs) & IO_WAITID_REF_MASK)
		return 1;

		req->io_task_work.func = io_waitid_cb;
		io_req_task_work_add(req);
		list_del_init(&wait->entry);
		return 1;
		}