* Re: FAILED: patch "[PATCH] io_uring/waitid: fix KCSAN warning on io_waitid->head" failed to apply to 6.12-stable tree
2026-09-30 14:59 FAILED: patch "[PATCH] io_uring/waitid: fix KCSAN warning on io_waitid->head" failed to apply to 6.12-stable tree gregkh
@ 2026-10-12 21:26 ` Jens Axboe
2026-10-13 6:25 ` Greg KH
0 siblings, 1 reply; 3+ messages in thread
From: Jens Axboe @ 2026-10-12 21:26 UTC (permalink / raw)
To: gregkh; +Cc: stable
[-- Attachment #1: Type: text/plain, Size: 864 bytes --]
On 9/30/26 8:59 AM, gregkh@linuxfoundation.org wrote:
>
> The patch below does not apply to the 6.12-stable tree.
> If someone wants it applied there, or to any other stable or longterm
> tree, then please email the backport, including the original git commit
> id to <stable@vger.kernel.org>.
>
> To reproduce the conflict and resubmit, you may use the following commands:
>
> git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.12.y
> git checkout FETCH_HEAD
> git cherry-pick -x b994ace83a2bc7699420f6a4c6b860c8da133159
> # <resolve conflicts, build, test, etc.>
> git commit -s
> git send-email --to '<stable@vger.kernel.org>' --in-reply-to '2026093018-boneless-remorse-ee12@gregkh' --subject-prefix 'PATCH 6.12.y' 'HEAD^..'
>
> Possible dependencies:
Missing dependency, here's the dep with the commit too.
--
Jens Axboe
[-- Attachment #2: 0002-io_uring-waitid-fix-KCSAN-warning-on-io_waitid-head.patch --]
[-- Type: text/x-patch, Size: 1693 bytes --]
From 709b6407ff6d73998f0bec0e39e3bd05cc04b099 Mon Sep 17 00:00:00 2001
From: Jens Axboe <axboe@kernel.dk>
Date: Mon, 19 Jan 2026 19:46:26 -0700
Subject: [PATCH 2/2] io_uring/waitid: fix KCSAN warning on io_waitid->head
Commit b994ace83a2bc7699420f6a4c6b860c8da133159 upstream.
Storing of the iw->head entry inside the wait_queue callback, or when
removing a waitid item, really should use proper load/store
acquire/release semantics, and KCSAN correctly warns of that. Ensure
that they do so.
Reported-by: syzbot+eb441775f4f948a0902f@syzkaller.appspotmail.com
Fixes: a48c0cbf28c0 ("io_uring/waitid: have io_waitid_complete() remove wait queue entry")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
---
io_uring/waitid.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/io_uring/waitid.c b/io_uring/waitid.c
index 852065df8024..7f3a6c2d9f80 100644
--- a/io_uring/waitid.c
+++ b/io_uring/waitid.c
@@ -120,11 +120,11 @@ static void io_waitid_remove_wq(struct io_kiocb *req)
struct io_waitid *iw = io_kiocb_to_cmd(req, struct io_waitid);
struct wait_queue_head *head;
- head = READ_ONCE(iw->head);
+ head = smp_load_acquire(&iw->head);
if (head) {
struct io_waitid_async *iwa = req->async_data;
- iw->head = NULL;
+ smp_store_release(&iw->head, NULL);
spin_lock_irq(&head->lock);
list_del_init(&iwa->wo.child_wait.entry);
spin_unlock_irq(&head->lock);
@@ -291,7 +291,7 @@ static int io_waitid_wait(struct wait_queue_entry *wait, unsigned mode,
return 0;
list_del_init(&wait->entry);
- iw->head = NULL;
+ smp_store_release(&iw->head, NULL);
/* cancel is in progress */
if (atomic_fetch_inc(&iw->refs) & IO_WAITID_REF_MASK)
--
2.56.0
[-- Attachment #3: 0001-io_uring-waitid-use-io_waitid_remove_wq-consistently.patch --]
[-- Type: text/x-patch, Size: 2872 bytes --]
From c8e76b37166c854ebee04560c79e03f6511e5dfe Mon Sep 17 00:00:00 2001
From: Jens Axboe <axboe@kernel.dk>
Date: Thu, 9 Oct 2025 10:55:08 -0600
Subject: [PATCH 1/2] io_uring/waitid: use io_waitid_remove_wq() consistently
Commit ab673c1bcaf20ac70352eeb6bf5b828462676693 upstream.
Use it everywhere that the wait_queue_entry is removed from the head,
and be a bit more cautious in zeroing out iw->head whenever the entry is
removed from the list.
Signed-off-by: Jens Axboe <axboe@kernel.dk>
---
io_uring/waitid.c | 15 +++++++++++----
1 file changed, 11 insertions(+), 4 deletions(-)
diff --git a/io_uring/waitid.c b/io_uring/waitid.c
index e0f049ce5280..852065df8024 100644
--- a/io_uring/waitid.c
+++ b/io_uring/waitid.c
@@ -225,18 +225,18 @@ bool io_waitid_remove_all(struct io_ring_ctx *ctx, struct task_struct *task,
static inline bool io_waitid_drop_issue_ref(struct io_kiocb *req)
{
struct io_waitid *iw = io_kiocb_to_cmd(req, struct io_waitid);
- struct io_waitid_async *iwa = req->async_data;
if (!atomic_sub_return(1, &iw->refs))
return false;
+ io_waitid_remove_wq(req);
+
/*
* Wakeup triggered, racing with us. It was prevented from
* completing because of that, queue up the tw to do that.
*/
req->io_task_work.func = io_waitid_cb;
io_req_task_work_add(req);
- remove_wait_queue(iw->head, &iwa->wo.child_wait);
return true;
}
@@ -291,6 +291,7 @@ static int io_waitid_wait(struct wait_queue_entry *wait, unsigned mode,
return 0;
list_del_init(&wait->entry);
+ iw->head = NULL;
/* cancel is in progress */
if (atomic_fetch_inc(&iw->refs) & IO_WAITID_REF_MASK)
@@ -311,6 +312,7 @@ int io_waitid_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
iw->which = READ_ONCE(sqe->len);
iw->upid = READ_ONCE(sqe->fd);
iw->options = READ_ONCE(sqe->file_index);
+ iw->head = NULL;
iw->infop = u64_to_user_ptr(READ_ONCE(sqe->addr2));
memset(&iw->info, 0, sizeof(iw->info));
return 0;
@@ -348,11 +350,16 @@ int io_waitid(struct io_kiocb *req, unsigned int issue_flags)
* callback.
*/
io_ring_submit_lock(ctx, issue_flags);
+
+ /*
+ * iw->head is valid under the ring lock, and as long as the request
+ * is on the waitid_list where cancelations may find it.
+ */
+ iw->head = ¤t->signal->wait_chldexit;
hlist_add_head(&req->hash_node, &ctx->waitid_list);
init_waitqueue_func_entry(&iwa->wo.child_wait, io_waitid_wait);
iwa->wo.child_wait.private = req->task;
- iw->head = ¤t->signal->wait_chldexit;
add_wait_queue(iw->head, &iwa->wo.child_wait);
ret = __do_wait(&iwa->wo);
@@ -375,7 +382,7 @@ int io_waitid(struct io_kiocb *req, unsigned int issue_flags)
}
hlist_del_init(&req->hash_node);
- remove_wait_queue(iw->head, &iwa->wo.child_wait);
+ io_waitid_remove_wq(req);
ret = io_waitid_finish(req, ret);
io_ring_submit_unlock(ctx, issue_flags);
--
2.56.0
^ permalink raw reply related [flat|nested] 3+ messages in thread