* Re: [PATCH] io_uring/sqpoll: make io_sq_thread_stop() idempotent
[not found] <20261105090101.3210622-1-yanghaoming@kaihong.com>
@ 2026-11-05 9:01 ` syzbot
0 siblings, 0 replies; only message in thread
From: syzbot @ 2026-11-05 9:01 UTC (permalink / raw)
To: yanghaoming; +Cc: yanghaoming, linux-kernel, syzkaller-bugs
> #syz test
This crash does not have a reproducer. I cannot test it.
>
> Please test this fix on upstream.
>
> IO_SQ_THREAD_SHOULD_STOP may already be set when io_sq_thread() exits on its
> own. The last ring still calls io_sq_thread_stop() from io_put_sq_data(),
> which tripped WARN_ON_ONCE(). Reproduced on 7.4-rc1 with IORING_SETUP_SQPOLL
> + close(ring_fd), which triggered WARNING at io_uring/sqpoll.c:88 before this
> patch. With this patch applied, the same repro no longer warns (also verified
> via QEMU initramfs repro). Fixes: 22d9db9fd64a ("io_uring/sqpoll: don't
> attach to a thread that is canceling") Reported-by:
> syzbot+9f32706bfd7c4ff81434@syzkaller.appspotmail.com Link:
> https://syzbot.org/bug?extid=9f32706bfd7c4ff81434 Tested-by: yanghaoming
> <yanghaoming@kaihong.com>
>
> Signed-off-by: yanghaoming <yanghaoming@kaihong.com>
> ---
> io_uring/sqpoll.c | 7 +++++--
> 1 file changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/io_uring/sqpoll.c b/io_uring/sqpoll.c
> index c833e776320d..f0c9e07c2d04 100644
> --- a/io_uring/sqpoll.c
> +++ b/io_uring/sqpoll.c
> @@ -80,14 +80,17 @@ static void io_sq_data_release(struct io_sq_data *sqd)
> * ctx_list by now and have no request left, so the thread can reach none of
> * them. What it still uses is its own or counted: the sqd by free_refs, the
> * hash of its io-wq by hash->refs.
> + *
> + * IO_SQ_THREAD_SHOULD_STOP may already be set if io_sq_thread() is exiting on
> + * its own; only wake a thread that is still running.
> */
> void io_sq_thread_stop(struct io_sq_data *sqd)
> {
> struct task_struct *tsk;
>
> - WARN_ON_ONCE(test_bit(IO_SQ_THREAD_SHOULD_STOP, &sqd->state));
> + if (test_and_set_bit(IO_SQ_THREAD_SHOULD_STOP, &sqd->state))
> + return;
>
> - set_bit(IO_SQ_THREAD_SHOULD_STOP, &sqd->state);
> mutex_lock(&sqd->lock);
> tsk = sqpoll_task_locked(sqd);
> if (tsk) {
> --
> 2.34.1
>
^ permalink raw reply [flat|nested] only message in thread