diff options
| author | Jens Axboe <axboe@kernel.dk> | 2025-10-07 07:46:00 -0600 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-10-15 12:00:20 +0200 |
| commit | 696ba6032081e617564a8113a001b8d7943cb928 (patch) | |
| tree | fa2d1e8532a7a8326a1cc1425c9d1a0218c81b90 /include/net/aligned_data.h | |
| parent | 37bd91f22794dc05436130d6983302cb90ecfe7e (diff) | |
io_uring/waitid: always prune wait queue entry in io_waitid_wait()
commit 2f8229d53d984c6a05b71ac9e9583d4354e3b91f upstream.
For a successful return, always remove our entry from the wait queue
entry list. Previously this was skipped if a cancelation was in
progress, but this can race with another invocation of the wait queue
entry callback.
Cc: stable@vger.kernel.org
Fixes: f31ecf671ddc ("io_uring: add IORING_OP_WAITID support")
Reported-by: syzbot+b9e83021d9c642a33d8c@syzkaller.appspotmail.com
Tested-by: syzbot+b9e83021d9c642a33d8c@syzkaller.appspotmail.com
Link: https://lore.kernel.org/io-uring/68e5195e.050a0220.256323.001f.GAE@google.com/
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'include/net/aligned_data.h')
0 files changed, 0 insertions, 0 deletions