diff options
| author | Jens Axboe <axboe@kernel.dk> | 2026-01-19 19:46:26 -0700 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2026-01-19 19:55:30 -0700 |
| commit | b994ace83a2bc7699420f6a4c6b860c8da133159 (patch) | |
| tree | f1a0c0ec4b2394170a6d4f7cef1560aab9005c20 /io_uring/waitid.c | |
| parent | 4b9748055457ac3a0710bf210c229d01ea1b01b9 (diff) | |
io_uring/waitid: fix KCSAN warning on io_waitid->head
Storing of the iw->head entry inside the wait_queue callback, or when
removing a waitid item, really should use proper load/store
acquire/release semantics, and KCSAN correctly warns of that. Ensure
that they do so.
Reported-by: syzbot+eb441775f4f948a0902f@syzkaller.appspotmail.com
Fixes: a48c0cbf28c0 ("io_uring/waitid: have io_waitid_complete() remove wait queue entry")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'io_uring/waitid.c')
| -rw-r--r-- | io_uring/waitid.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/io_uring/waitid.c b/io_uring/waitid.c index 2d4cbd47c67c..d25d60aed6af 100644 --- a/io_uring/waitid.c +++ b/io_uring/waitid.c @@ -114,11 +114,11 @@ static void io_waitid_remove_wq(struct io_kiocb *req) struct io_waitid *iw = io_kiocb_to_cmd(req, struct io_waitid); struct wait_queue_head *head; - head = READ_ONCE(iw->head); + head = smp_load_acquire(&iw->head); if (head) { struct io_waitid_async *iwa = req->async_data; - iw->head = NULL; + smp_store_release(&iw->head, NULL); spin_lock_irq(&head->lock); list_del_init(&iwa->wo.child_wait.entry); spin_unlock_irq(&head->lock); @@ -246,7 +246,7 @@ static int io_waitid_wait(struct wait_queue_entry *wait, unsigned mode, return 0; list_del_init(&wait->entry); - iw->head = NULL; + smp_store_release(&iw->head, NULL); /* cancel is in progress */ if (atomic_fetch_inc(&iw->refs) & IO_WAITID_REF_MASK) |