Jens Axboe 101e596e74 io_uring/fdinfo: cap SQ iteration at max SQ entries ...

A previous commit changed the logic around how SQ entries are iterated,
and as a result, had a few bugs. One is that it fully trusts the SQ
head and tail, which are user exposed. Another is that it fails to
increment the SQ head if the SQ index is out of range.

Fix both of those up, reverting to the previous logic of how to
iterate SQ entries.

Link: https://lore.kernel.org/io-uring/68ffdf18.050a0220.3344a1.039e.GAE@google.com/
Fixes: 1cba30bf9f ("io_uring: add support for IORING_SETUP_SQE_MIXED")
Reported-by: syzbot+10a9b495f54a17b607a6@syzkaller.appspotmail.com
Tested-by: syzbot+10a9b495f54a17b607a6@syzkaller.appspotmail.com
Reviewed-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

2025-10-27 19:19:13 -06:00

..

advise.c

io_uring: finish IOU_OK -> IOU_COMPLETE transition

2025-05-21 08:41:16 -06:00

advise.h

…

alloc_cache.c

io_uring: add alloc_cache.c

2025-01-28 15:10:40 -07:00

alloc_cache.h

io_uring/net: convert to struct iou_vec

2025-03-07 13:41:08 -07:00

cancel.c

io_uring: don't include filetable.h in io_uring.h

2025-09-08 13:20:46 -06:00

cancel.h

io_uring/cancel: add generic cancel helper

2025-02-17 05:34:45 -07:00

cmd_net.c

io_uring/uring_cmd: add support for IORING_SETUP_CQE_MIXED

2025-08-27 11:24:15 -06:00

epoll.c

io_uring: finish IOU_OK -> IOU_COMPLETE transition

2025-05-21 08:41:16 -06:00

epoll.h

io_uring/epoll: add support for IORING_OP_EPOLL_WAIT

2025-02-20 07:59:56 -07:00

eventfd.c

io_uring/eventfd: open code io_eventfd_grab()

2025-04-24 08:33:54 -06:00

eventfd.h

io_uring/eventfd: dedup signalling helpers

2025-04-24 08:33:54 -06:00

fdinfo.c

io_uring/fdinfo: cap SQ iteration at max SQ entries

2025-10-27 19:19:13 -06:00

fdinfo.h

…

filetable.c

io_uring: cache nodes and mapped buffers

2025-02-28 07:05:46 -07:00

filetable.h

io_uring/rsrc: pass 'struct io_ring_ctx' reference to rsrc helpers

2024-11-07 15:24:33 -07:00

fs.c

io_uring: finish IOU_OK -> IOU_COMPLETE transition

2025-05-21 08:41:16 -06:00

fs.h

…

futex.c

io_uring: add async data clear/free helpers

2025-08-27 11:24:25 -06:00

futex.h

io_uring: move cancelations to be io_uring_task based

2024-11-06 13:55:38 -07:00

io_uring.c

io_uring: check for user passing 0 nr_submit

2025-10-22 11:12:54 -06:00

io_uring.h

io_uring: add support for IORING_SETUP_SQE_MIXED

2025-10-22 07:34:57 -06:00

io-wq.c

io_uring/io-wq: fix max_workers breakage and nr_workers underflow

2025-09-15 10:46:13 -06:00

io-wq.h

io_uring/wq: avoid indirect do_work/free_work calls

2025-04-21 05:06:58 -06:00

kbuf.c

io_uring/kbuf: use io_create_region for kbuf creation

2025-10-20 10:37:56 -06:00

kbuf.h

io-uring: move struct io_br_sel into io_uring_types.h

2025-08-24 11:41:12 -06:00

Kconfig

io_uring: make zcrx depend on CONFIG_IO_URING

2025-03-31 07:07:44 -06:00

Makefile

io_uring: introduce io_uring querying

2025-09-08 08:06:37 -06:00

memmap.c

io_uring: only publish fully handled mem region

2025-10-20 10:37:56 -06:00

memmap.h

io_uring: only publish fully handled mem region

2025-10-20 10:37:56 -06:00

mock_file.c

io_uring/mock: add trivial poll handler

2025-07-02 08:10:26 -06:00

msg_ring.c

io_uring/msg_ring: kill alloc_cache for io_kiocb allocations

2025-09-18 13:59:15 -06:00

msg_ring.h

io_uring/msg_ring: Drop custom destructor

2024-12-27 10:08:21 -07:00

napi.c

net: use napi_id_valid helper

2025-02-17 16:43:04 -08:00

napi.h

io_uring/napi: add static napi tracking strategy

2024-11-06 13:55:38 -07:00

net.c

io_uring: don't include filetable.h in io_uring.h

2025-09-08 13:20:46 -06:00

net.h

io_uring/net: convert to struct iou_vec

2025-03-07 13:41:08 -07:00

nop.c

io_uring/nop: add support for IORING_SETUP_CQE_MIXED

2025-08-27 11:24:15 -06:00

nop.h

…

notif.c

Merge tag 'for-6.18/io_uring-20250929' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

2025-10-02 09:56:23 -07:00

notif.h

io_uring/notif: implement notification stacking

2024-04-22 19:31:18 -06:00

opdef.c

io_uring: add support for IORING_SETUP_SQE_MIXED

2025-10-22 07:34:57 -06:00

opdef.h

io_uring: add support for IORING_SETUP_SQE_MIXED

2025-10-22 07:34:57 -06:00

openclose.c

io_uring: don't include filetable.h in io_uring.h

2025-09-08 13:20:46 -06:00

openclose.h

io_uring: add support for IORING_OP_PIPE

2025-04-21 05:06:58 -06:00

poll.c

io_uring: unify task_work cancelation checks

2025-10-20 10:37:48 -06:00

poll.h

io_uring/poll: introduce io_arm_apoll()

2025-06-23 09:00:12 -06:00

query.c

io_uring/query: cap number of queries

2025-09-19 07:06:43 -06:00

query.h

io_uring: introduce io_uring querying

2025-09-08 08:06:37 -06:00

refs.h

io_uring: always do atomic put from iowq

2025-04-03 08:31:57 -06:00

register.c

io_uring: add support for IORING_SETUP_SQE_MIXED

2025-10-22 07:34:57 -06:00

register.h

io_uring: temporarily disable registered waits

2024-11-15 09:58:34 -07:00

rsrc.c

io_uring/rsrc: respect submitter_task in io_register_clone_buffers()

2025-09-08 13:21:24 -06:00

rsrc.h

io_uring: export io_[un]account_mem

2025-07-16 16:23:28 -06:00

rw.c

io_uring/rw: check for NULL io_br_sel when putting a buffer

2025-10-15 13:38:53 -06:00

rw.h

io_uring/kbuf: pass bgid to io_buffer_select()

2025-04-21 05:06:58 -06:00

slist.h

io_uring: silence variable ‘prev’ set but not used warning

2023-03-09 10:10:58 -07:00

splice.c

io_uring: don't include filetable.h in io_uring.h

2025-09-08 13:20:46 -06:00

splice.h

io_uring/splice: open code 2nd direct file assignment

2024-10-29 13:43:28 -06:00

sqpoll.c

io_uring/sqpoll: don't put task_struct on tctx setup failure

2025-06-17 06:43:18 -06:00

sqpoll.h

io_uring: consistently use rcu semantics with sqpoll thread

2025-06-12 08:17:09 -06:00

statx.c

io_uring: finish IOU_OK -> IOU_COMPLETE transition

2025-05-21 08:41:16 -06:00

statx.h

…

sync.c

io_uring: finish IOU_OK -> IOU_COMPLETE transition

2025-05-21 08:41:16 -06:00

sync.h

…

tctx.c

io_uring/wq: avoid indirect do_work/free_work calls

2025-04-21 05:06:58 -06:00

tctx.h

io_uring: simplify __io_uring_add_tctx_node

2022-10-07 12:25:30 -06:00

timeout.c

io_uring: unify task_work cancelation checks

2025-10-20 10:37:48 -06:00

timeout.h

io_uring/timeout: don't export link t-out disarm helper

2025-05-06 10:11:23 -06:00

truncate.c

io_uring: finish IOU_OK -> IOU_COMPLETE transition

2025-05-21 08:41:16 -06:00

truncate.h

io_uring: add support for ftruncate

2024-02-09 09:04:39 -07:00

uring_cmd.c

io_uring: add support for IORING_SETUP_SQE_MIXED

2025-10-22 07:34:57 -06:00

uring_cmd.h

io_uring/cmd: remove struct io_uring_cmd_data

2025-07-18 12:34:56 -06:00

waitid.c

io_uring/waitid: use io_waitid_remove_wq() consistently

2025-10-20 10:37:48 -06:00

waitid.h

io_uring: move cancelations to be io_uring_task based

2024-11-06 13:55:38 -07:00

xattr.c

io_uring: finish IOU_OK -> IOU_COMPLETE transition

2025-05-21 08:41:16 -06:00

xattr.h

…

zcrx.c

io_uring/zcrx: increment fallback loop src offset

2025-10-08 07:26:14 -06:00

zcrx.h

io_uring/zcrx: allow synchronous buffer return

2025-09-16 12:37:21 -06:00