From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-oa1-f44.google.com (mail-oa1-f44.google.com [209.85.160.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B71AB22068D for ; Thu, 14 May 2026 13:26:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.160.44 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778765166; cv=none; b=ShYwlKfKo0VA1o30rQfLfxxvy8XdvI7Qz/Gc4gjTAZ1x4/oyNxu/KHvf8+SdCcnfqrD6mVK9k2lqLEylL/whq2OWZ6a+9i7v/4uCi+Nfwu+4S8b5zLqZpZil6LM010si+rxRCeTqspT6TIyPP9enZlS/95qvHiCJp41Udb/Wb3Q= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778765166; c=relaxed/simple; bh=7uCudAWp/2ugWV7GwpWv8i8qCVITPuVE6+slUhHCnIM=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=LQNhe3LR3rTFpDRYmWk1Olyyefi/53kIuNHC5x+tebvABrvm9jqsUW+mZp4Ry39yOCzTAqX7PrPa69cnCDvvOgkVD3Lz4XOy+Gr+sx41NwtCIWPJBmUesK11zE4Fi7phou4JiqBUrBdG/o+CHZQuB3KJoEwFYwpSBOnrgwB4LEI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kernel.dk; spf=pass smtp.mailfrom=kernel.dk; dkim=pass (2048-bit key) header.d=kernel-dk.20251104.gappssmtp.com header.i=@kernel-dk.20251104.gappssmtp.com header.b=mawDdgnV; arc=none smtp.client-ip=209.85.160.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kernel.dk Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=kernel.dk Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel-dk.20251104.gappssmtp.com header.i=@kernel-dk.20251104.gappssmtp.com header.b="mawDdgnV" Received: by mail-oa1-f44.google.com with SMTP id 586e51a60fabf-439cc157c21so985106fac.1 for ; Thu, 14 May 2026 06:26:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel-dk.20251104.gappssmtp.com; s=20251104; t=1778765163; x=1779369963; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=DREA9g2Kfe7wmoiXBkymc+fgvMh17jjhzIZtNHnDePI=; b=mawDdgnVgWBDu18yyeFCYj2P5hiYA+a1FshfyNzcvkJ+eJmPlZIk2IxTLKChRuDBjf AOqWWWGYdMMNuxB9CIyM62M58nCbkhUfFl6T5Th2y8Fxa2nNVLwlVf9y7xj4j6EWVm2W uj00ydIakDEiquTIezJ7YY7+hQ27ELiQaIKJe3WWcjeNPRrLrV//ZqlNd7P5ZT6abzQh 4onKEeobb91Nofo04gu+S0JNFpytclUKTzpm1caljmAQLt+Xdizl0QWIknpuTC6xVv7/ l8BWBHz15LisVtrKBo2Q/0PIU9O2Zoud1JQlQ/we+/da/DLWmQp0m7o3f9FeY2GzTHxu ncMg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1778765163; x=1779369963; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=DREA9g2Kfe7wmoiXBkymc+fgvMh17jjhzIZtNHnDePI=; b=OW2lAt+lP26EdG8droEwrhG9a9jtfkHrc5Lbue/r0jaO3FDKDRu9yjg9Viagj2vjXx pEm3cKQD1Sp0r5ng5dCgc3HHcefWbkHyXxUBr+PM97lvLQMSSFqhY2dervbfdWiwn5NU 2j5m20Wf6NZsanaQkY7/WOBMW3LKb9ZzkDlmMOLJuNtE2/yC6Qzswex0RhrxQG8+FrZs WXVje5VC8yoZk/Z3/LbwdfgwQZEYuQXi42xAps2E5E1cTizwnekfoKZvxFad8+Pp8YZp YR64Ueyq4RhXDc5LWtDN9upRPfF8nIw2Gp2DmQtwdT/lmB8VoutVR2tQGi5wpalbTyvx yJjA== X-Gm-Message-State: AOJu0Yz5F1BBp5qf6NKiNTwYuzSyX3F/u1ctqWXSUm72iDBsGMGEZfTz MyYZEKa60Zf5fxhdO4PWdI2RHNiZQFh4exNlC786fjRLKrGFY7xdB8w4TMHoGmNGtu0= X-Gm-Gg: Acq92OENkU3Zc6qkn+zV8irXOme3i08Sd+DUvHpZZRE4Pyj7d/+Z8LXne0sae3Ie1KW mt8o2bErHnGA/ffAqiRK/XucOLuuH7zSTxUmaSb5ii3iRgaZHkbO5d91dmXO1dSwO4eLaGUD7ql RuFQicjMQaWCkO9ijUFs2whL7j8oN8su+1uwxxwDiNfjM/1Zv0AaAJNeKg8P0dbjkKTR3FsI5E6 JX5pGRcfO2tIYaL6tI6B8hftPaIYLeqkFjZFXdWMFzK5yEbGNU2TkcbsevuVRTdtohruGZTCmAP QpJo21exwWPmNQz1FehuJernRjcH2kqVTVmAaOYHsCbYMhc/qOVqRD83uPVPBWjlBvmOWZRB8k2 UgxUD2rHnFyDDjhBQyBSbVYdwzDFStwee8h2pgS3Bnt3553QOJx+61D/U4zGAF/NE4M/bvKLu+L qGF3pC+AJIP7bn1uuQs/MATbRIi5VrOa7RezEdgLV0Hknl/Ns03zsvAZZuq77Ah7bIv1vLVYUXb ABXkcQy X-Received: by 2002:a05:6870:5a3:b0:439:bae3:50b5 with SMTP id 586e51a60fabf-439ce452ca8mr4395299fac.34.1778765162752; Thu, 14 May 2026 06:26:02 -0700 (PDT) Received: from [192.168.1.102] ([96.43.243.2]) by smtp.gmail.com with ESMTPSA id 586e51a60fabf-439fc4d7ff3sm1849169fac.9.2026.05.14.06.26.01 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 14 May 2026 06:26:02 -0700 (PDT) Message-ID: Date: Thu, 14 May 2026 07:26:01 -0600 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH V2] io_uring: validate user-controlled cq.head in io_cqe_cache_refill() To: Zizhi Wo , asml.silence@gmail.com, io-uring@vger.kernel.org Cc: linux-kernel@vger.kernel.org, yangerkun@huawei.com, chengzhihao1@huawei.com References: <20260514021847.4062782-1-wozizhi@huaweicloud.com> Content-Language: en-US From: Jens Axboe In-Reply-To: <20260514021847.4062782-1-wozizhi@huaweicloud.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit On 5/13/26 8:18 PM, Zizhi Wo wrote: > From: Zizhi Wo > > [BUG] > A fuzzing run reproduced an unkillable io_uring task stuck at ~100% CPU: > > [root@fedora io_uring_stress]# ps -ef | grep io_uring > root 1240 1 99 13:36 ? 00:01:35 [io_uring_stress] > > The task loops inside io_cqring_wait() and never returns to userspace, and > SIGKILL has no effect. Thanks - applied with a few edits, see final result here: https://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux.git/commit/?h=io_uring-7.1&id=f44d38a31f1802b7222adaea9ee69f9d280f698a The comments (and commit message) read very LLM'ish, so dialed that back a bit. And there's no reason to put io_cqring_queued() in a header file when it's only used in io_uring.c. And finally, the 'queued' variable is now useless, so kill that too. -- Jens Axboe