Jens Axboe 696ba60320 io_uring/waitid: always prune wait queue entry in io_waitid_wait() ... commit 2f8229d53d984c6a05b71ac9e9583d4354e3b91f upstream. For a successful return, always remove our entry from the wait queue entry list. Previously this was skipped if a cancelation was in progress, but this can race with another invocation of the wait queue entry callback. Cc: stable@vger.kernel.org Fixes: f31ecf671d ("io_uring: add IORING_OP_WAITID support") Reported-by: syzbot+b9e83021d9c642a33d8c@syzkaller.appspotmail.com Tested-by: syzbot+b9e83021d9c642a33d8c@syzkaller.appspotmail.com Link: https://lore.kernel.org/io-uring/68e5195e.050a0220.256323.001f.GAE@google.com/ Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2025-10-15 12:00:20 +02:00
..
advise.c	io_uring/advise: support 64-bit lengths	2024-06-16 14:54:55 -06:00
advise.h
alloc_cache.h	io_uring/alloc_cache: switch to array based caching	2024-04-15 08:10:25 -06:00
cancel.c	io_uring: fix warnings on shadow variables	2024-04-15 08:10:26 -06:00
cancel.h	io_uring: fix cancellation overwriting req->flags	2024-06-13 19:25:28 -06:00
epoll.c
epoll.h
eventfd.c	io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period	2025-01-17 13:40:58 +01:00
eventfd.h	io_uring/eventfd: move eventfd handling to separate file	2024-06-16 14:54:55 -06:00
fdinfo.c	io_uring: fix use-after-free of sq->thread in __io_uring_show_fdinfo()	2025-06-19 15:32:33 +02:00
fdinfo.h
filetable.c	io_uring/filetable: don't unnecessarily clear/reset bitmap	2024-05-08 08:27:45 -06:00
filetable.h
fs.c
fs.h
futex.c	io_uring/futex: ensure io_futex_wait() cleans up properly on failure	2025-08-28 16:31:05 +02:00
futex.h	io_uring/alloc_cache: switch to array based caching	2024-04-15 08:10:25 -06:00
io_uring.c	io_uring/msg_ring: kill alloc_cache for io_kiocb allocations	2025-09-25 11:13:48 +02:00
io_uring.h	io_uring: include dying ring in task_work "should cancel" state	2025-09-25 11:13:47 +02:00
io-wq.c	io_uring: fix task leak issue in io_wq_create()	2025-06-27 11:11:36 +01:00
io-wq.h	io_uring/io-wq: make io_wq_work flags atomic	2024-06-16 14:54:55 -06:00
kbuf.c	io_uring/kbuf: flag partial buffer mappings	2025-07-06 11:01:48 +02:00
kbuf.h	io_uring/kbuf: drop WARN_ON_ONCE() from incremental length check	2025-09-25 11:13:48 +02:00
Makefile	io_uring: add GCOV_PROFILE_URING Kconfig option	2024-08-30 10:52:02 -06:00
memmap.c	io_uring: check for overflows in io_pin_pages	2024-12-05 14:02:50 +01:00
memmap.h	io_uring: move mapping/allocation helpers to a separate file	2024-04-15 08:10:26 -06:00
msg_ring.c	io_uring/msg_ring: kill alloc_cache for io_kiocb allocations	2025-09-25 11:13:48 +02:00
msg_ring.h	io_uring/msg_ring: add an alloc cache for io_kiocb entries	2024-06-24 08:39:55 -06:00
napi.c	io_uring: user registered clockid for wait timeouts	2024-08-25 08:27:01 -06:00
napi.h	io_uring/napi: postpone napi timeout adjustment	2024-08-25 08:27:01 -06:00
net.c	io_uring/net: commit partial buffers on retry	2025-08-28 16:31:04 +02:00
net.h	io_uring: Introduce IORING_OP_LISTEN	2024-06-19 07:57:21 -06:00
nop.c	io_uring: support to inject result for NOP	2024-05-10 06:09:45 -06:00
nop.h
notif.c	io_uring: fix incorrect io_kiocb reference in io_link_skb	2025-09-25 11:13:49 +02:00
notif.h	io_uring/notif: implement notification stacking	2024-04-22 19:31:18 -06:00
opdef.c	io_uring: make fallocate be hashed work	2025-07-17 18:37:21 +02:00
opdef.h	io_uring: Fix probe of disabled operations	2024-06-19 08:58:00 -06:00
openclose.c
openclose.h
poll.c	io_uring: include dying ring in task_work "should cancel" state	2025-09-25 11:13:47 +02:00
poll.h	io_uring/poll: shrink alloc cache size to 32	2024-04-15 08:10:25 -06:00
refs.h	io_uring: always do atomic put from iowq	2025-05-02 07:59:21 +02:00
register.c	io_uring: consistently use rcu semantics with sqpoll thread	2025-06-19 15:32:33 +02:00
register.h	io_uring: clean up a type in io_uring_register_get_file()	2024-09-16 12:04:10 -06:00
rsrc.c	io_uring/rsrc: don't rely on user vaddr alignment	2025-07-06 11:01:47 +02:00
rsrc.h	io_uring/rsrc: don't rely on user vaddr alignment	2025-07-06 11:01:47 +02:00
rw.c	io_uring/rw: cast rw->flags assignment to rwf_t	2025-08-20 18:30:58 +02:00
rw.h	io_uring/alloc_cache: switch to array based caching	2024-04-15 08:10:25 -06:00
slist.h
splice.c
splice.h
sqpoll.c	io_uring/sqpoll: don't put task_struct on tctx setup failure	2025-06-27 11:11:42 +01:00
sqpoll.h	io_uring: consistently use rcu semantics with sqpoll thread	2025-06-19 15:32:33 +02:00
statx.c	vfs: retire user_path_at_empty and drop empty arg from getname_flags	2024-06-05 17:03:57 +02:00
statx.h
sync.c
sync.h
tctx.c	io_uring/tctx: work around xa_store() allocation error issue	2024-12-14 20:04:10 +01:00
tctx.h
timeout.c	io_uring: include dying ring in task_work "should cancel" state	2025-09-25 11:13:47 +02:00
timeout.h
truncate.c
truncate.h
uring_cmd.c	io_uring: include dying ring in task_work "should cancel" state	2025-09-25 11:13:47 +02:00
uring_cmd.h	io_uring/alloc_cache: switch to array based caching	2024-04-15 08:10:25 -06:00
waitid.c	io_uring/waitid: always prune wait queue entry in io_waitid_wait()	2025-10-15 12:00:20 +02:00
waitid.h
xattr.c	vfs: retire user_path_at_empty and drop empty arg from getname_flags	2024-06-05 17:03:57 +02:00
xattr.h