Commit eda4623c authored by Pavel Begunkov's avatar Pavel Begunkov Committed by Jens Axboe
Browse files

io_uring/zcrx: init id for xa_find 



xa_find() interprets id as the lower bound and thus expects it initialised.

Reported-by: default avatar <syzbot+c3ff04150c30d3df0f57@syzkaller.appspotmail.com>
Fixes: 76f1cc98 ("io_uring/zcrx: add support for multiple ifqs")
Signed-off-by: default avatarPavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/faea44ef63131e6968f635e1b6b7ca6056f1f533.1748359655.git.asml.silence@gmail.com


Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 44ed0f35

io_uring/zcrx.c

+2 −1
Original line number Diff line number Diff line
@@ -630,12 +630,13 @@ int io_register_zcrx_ifq(struct io_ring_ctx *ctx, 
void io_unregister_zcrx_ifqs(struct io_ring_ctx *ctx)

{

	struct io_zcrx_ifq *ifq;

	unsigned long id;



	lockdep_assert_held(&ctx->uring_lock);



	while (1) {

		scoped_guard(mutex, &ctx->mmap_lock) {

			unsigned long id = 0;



			ifq = xa_find(&ctx->zcrx_ctxs, &id, ULONG_MAX, XA_PRESENT);

			if (ifq)

				xa_erase(&ctx->zcrx_ctxs, id);