Commit 530b0b61 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'io_uring-7.0-20260227' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux 

Pull io_uring fixes from Jens Axboe:
 "Just two minor patches in here, ensuring the use of READ_ONCE() for
  sqe field reading is consistent across the codebase. There were two
  missing cases, now they are covered too"

* tag 'io_uring-7.0-20260227' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  io_uring/timeout: READ_ONCE sqe->addr
  io_uring/cmd_net: use READ_ONCE() for ->addr3 read
parents 764a167f 85f6c439

io_uring/cmd_net.c

+1 −1
Original line number Diff line number Diff line
@@ -146,7 +146,7 @@ static int io_uring_cmd_getsockname(struct socket *sock, 
		return -EINVAL;



	uaddr = u64_to_user_ptr(READ_ONCE(sqe->addr));

	ulen = u64_to_user_ptr(sqe->addr3);

	ulen = u64_to_user_ptr(READ_ONCE(sqe->addr3));

	peer = READ_ONCE(sqe->optlen);

	if (peer > 1)

		return -EINVAL;

io_uring/timeout.c

+2 −2
Original line number Diff line number Diff line
@@ -462,7 +462,7 @@ int io_timeout_remove_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) 
			tr->ltimeout = true;

		if (tr->flags & ~(IORING_TIMEOUT_UPDATE_MASK|IORING_TIMEOUT_ABS))

			return -EINVAL;

		if (get_timespec64(&tr->ts, u64_to_user_ptr(sqe->addr2)))

		if (get_timespec64(&tr->ts, u64_to_user_ptr(READ_ONCE(sqe->addr2))))

			return -EFAULT;

		if (tr->ts.tv_sec < 0 || tr->ts.tv_nsec < 0)

			return -EINVAL;
@@ -557,7 +557,7 @@ static int __io_timeout_prep(struct io_kiocb *req, 
	data->req = req;

	data->flags = flags;



	if (get_timespec64(&data->ts, u64_to_user_ptr(sqe->addr)))

	if (get_timespec64(&data->ts, u64_to_user_ptr(READ_ONCE(sqe->addr))))

		return -EFAULT;



	if (data->ts.tv_sec < 0 || data->ts.tv_nsec < 0)