[PATCH 0/2] Misc minor tctx fixes

[PATCH 0/2] Misc minor tctx fixes

[Jens Axboe]

Hi,

Just two small fixes for issues introduced in this merge window.

-- 
Jens Axboe

[PATCH 1/2] io_uring/tctx: check for setup tctx->io_wq before teardown

[Jens Axboe]

As with the idling code before it, the error exit path should check for
a NULL tctx->io_wq before calling io_wq_put_and_exit().

Fixes: 7880174e1e5e ("io_uring/tctx: clean up __io_uring_add_tctx_node() error handling")
Reported-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
---
 io_uring/tctx.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/io_uring/tctx.c b/io_uring/tctx.c
index 61533f30494f..c011a593c0ad 100644
--- a/io_uring/tctx.c
+++ b/io_uring/tctx.c
@@ -171,7 +171,8 @@ int __io_uring_add_tctx_node(struct io_ring_ctx *ctx)
 	}
 	if (!current->io_uring) {
 err_free:
-		io_wq_put_and_exit(tctx->io_wq);
+		if (tctx->io_wq)
+			io_wq_put_and_exit(tctx->io_wq);
 		percpu_counter_destroy(&tctx->inflight);
 		kfree(tctx);
 	}
-- 
2.53.0

[PATCH 2/2] io_uring/tctx: mark io_wq as exiting before error path teardown

[Jens Axboe]

syzbot reports that it's hitting the below condition for exiting an
io_wq context:

WARN_ON_ONCE(!test_bit(IO_WQ_BIT_EXIT, &wq->state))

in io_wq_put_and_exit(), which can be triggered with memory allocation
fault injection. Ensure that the io_wq is marked as exiting to silence
this warning trigger.

Reported-by: syzbot+79a4cc863a8db58cd92b@syzkaller.appspotmail.com
Fixes: 7880174e1e5e ("io_uring/tctx: clean up __io_uring_add_tctx_node() error handling")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
---
 io_uring/tctx.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/io_uring/tctx.c b/io_uring/tctx.c
index c011a593c0ad..80366320276d 100644
--- a/io_uring/tctx.c
+++ b/io_uring/tctx.c
@@ -171,8 +171,10 @@ int __io_uring_add_tctx_node(struct io_ring_ctx *ctx)
 	}
 	if (!current->io_uring) {
 err_free:
-		if (tctx->io_wq)
+		if (tctx->io_wq) {
+			io_wq_exit_start(tctx->io_wq);
 			io_wq_put_and_exit(tctx->io_wq);
+		}
 		percpu_counter_destroy(&tctx->inflight);
 		kfree(tctx);
 	}
-- 
2.53.0

Re: [PATCH 1/2] io_uring/tctx: check for setup tctx->io_wq before teardown

[Clément Léger]

On 4/16/26 22:05, Jens Axboe wrote:
> > 
> As with the idling code before it, the error exit path should check for
> a NULL tctx->io_wq before calling io_wq_put_and_exit().
> 
> Fixes: 7880174e1e5e ("io_uring/tctx: clean up __io_uring_add_tctx_node() error handling")
> Reported-by: Dan Carpenter <error27@gmail.com>
> Signed-off-by: Jens Axboe <axboe@kernel.dk>
> ---
>   io_uring/tctx.c | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/io_uring/tctx.c b/io_uring/tctx.c
> index 61533f30494f..c011a593c0ad 100644
> --- a/io_uring/tctx.c
> +++ b/io_uring/tctx.c
> @@ -171,7 +171,8 @@ int __io_uring_add_tctx_node(struct io_ring_ctx *ctx)
>   	}
>   	if (!current->io_uring) {
>   err_free:
> -		io_wq_put_and_exit(tctx->io_wq);
> +		if (tctx->io_wq)
> +			io_wq_put_and_exit(tctx->io_wq);
>   		percpu_counter_destroy(&tctx->inflight);
>   		kfree(tctx);
>   	}

Hi Jens,

LGTM,

Reviewed-by: Clément Léger <cleger@meta.com>

Thanks,

Clément

Re: [PATCH 2/2] io_uring/tctx: mark io_wq as exiting before error path teardown

[Clément Léger]

On 4/16/26 22:05, Jens Axboe wrote:
> > 
> syzbot reports that it's hitting the below condition for exiting an
> io_wq context:
> 
> WARN_ON_ONCE(!test_bit(IO_WQ_BIT_EXIT, &wq->state))
> 
> in io_wq_put_and_exit(), which can be triggered with memory allocation
> fault injection. Ensure that the io_wq is marked as exiting to silence
> this warning trigger.
> 
> Reported-by: syzbot+79a4cc863a8db58cd92b@syzkaller.appspotmail.com
> Fixes: 7880174e1e5e ("io_uring/tctx: clean up __io_uring_add_tctx_node() error handling")
> Signed-off-by: Jens Axboe <axboe@kernel.dk>
> ---
>   io_uring/tctx.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/io_uring/tctx.c b/io_uring/tctx.c
> index c011a593c0ad..80366320276d 100644
> --- a/io_uring/tctx.c
> +++ b/io_uring/tctx.c
> @@ -171,8 +171,10 @@ int __io_uring_add_tctx_node(struct io_ring_ctx *ctx)
>   	}
>   	if (!current->io_uring) {
>   err_free:
> -		if (tctx->io_wq)
> +		if (tctx->io_wq) {
> +			io_wq_exit_start(tctx->io_wq);
>   			io_wq_put_and_exit(tctx->io_wq);
> +		}
>   		percpu_counter_destroy(&tctx->inflight);
>   		kfree(tctx);
>   	}

Hi Jens,

LGTM as well,

Reviewed-by: Clément Léger <cleger@meta.com>

Thanks,

Clément