diff options
| author | Jens Axboe <axboe@kernel.dk> | 2026-01-20 09:53:43 -0700 |
|---|---|---|
| committer | Sasha Levin <sashal@kernel.org> | 2026-03-04 07:19:38 -0500 |
| commit | c83adcae52fe5dfa9a8c7cb84ffeb4b3596e6972 (patch) | |
| tree | 2a2556bbbd706a05dd6d48bb2bc9ae88876aec58 /io_uring | |
| parent | 81aae2a7b8207690a0a5a14d4ebc6c4a90981709 (diff) | |
io_uring/timeout: annotate data race in io_flush_timeouts()
[ Upstream commit 42b12cb5fd4554679bac06bbdd05dc8b643bcc42 ]
syzbot correctly reports this as a KCSAN race, as ctx->cached_cq_tail
should be read under ->uring_lock. This isn't immediately feasible in
io_flush_timeouts(), but as long as we read a stable value, that should
be good enough. If two io-wq threads compete on this value, then they
will both end up calling io_flush_timeouts() and at least one of them
will see the correct value.
Reported-by: syzbot+6c48db7d94402407301e@syzkaller.appspotmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'io_uring')
| -rw-r--r-- | io_uring/timeout.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/io_uring/timeout.c b/io_uring/timeout.c index d8fbbaf31cf3..84dda24f3eb2 100644 --- a/io_uring/timeout.c +++ b/io_uring/timeout.c @@ -130,7 +130,7 @@ __cold void io_flush_timeouts(struct io_ring_ctx *ctx) u32 seq; raw_spin_lock_irq(&ctx->timeout_lock); - seq = ctx->cached_cq_tail - atomic_read(&ctx->cq_timeouts); + seq = READ_ONCE(ctx->cached_cq_tail) - atomic_read(&ctx->cq_timeouts); list_for_each_entry_safe(timeout, tmp, &ctx->timeout_list, list) { struct io_kiocb *req = cmd_to_io_kiocb(timeout); |