diff options
| author | Pavel Begunkov <asml.silence@gmail.com> | 2025-05-27 16:27:57 +0100 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2025-05-27 10:09:15 -0600 |
| commit | eda4623cf989d033c07355be1469e44f321ce8ae (patch) | |
| tree | 13383625187fe86d2509ce0e14753f1d4dd4c759 | |
| parent | 44ed0f35df343d00b8d38006854f96e333104a66 (diff) | |
io_uring/zcrx: init id for xa_find
xa_find() interprets id as the lower bound and thus expects it initialised.
Reported-by: syzbot+c3ff04150c30d3df0f57@syzkaller.appspotmail.com
Fixes: 76f1cc98b23ce ("io_uring/zcrx: add support for multiple ifqs")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/faea44ef63131e6968f635e1b6b7ca6056f1f533.1748359655.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
| -rw-r--r-- | io_uring/zcrx.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c index 9a568d049204..0c5b7d8f8d67 100644 --- a/io_uring/zcrx.c +++ b/io_uring/zcrx.c @@ -630,12 +630,13 @@ ifq_free: void io_unregister_zcrx_ifqs(struct io_ring_ctx *ctx) { struct io_zcrx_ifq *ifq; - unsigned long id; lockdep_assert_held(&ctx->uring_lock); while (1) { scoped_guard(mutex, &ctx->mmap_lock) { + unsigned long id = 0; + ifq = xa_find(&ctx->zcrx_ctxs, &id, ULONG_MAX, XA_PRESENT); if (ifq) xa_erase(&ctx->zcrx_ctxs, id); |