Re: [PATCH V2] io_uring: validate user-controlled cq.head in io_cqe_cache_refill()
Jens Axboe <[email protected]>
| Newsgroups | org.kernel.vger.io-uring,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <177876506441.606701.15151656344889553957.b4-ty@b4> |
On Thu, 14 May 2026 10:18:47 +0800, Zizhi Wo wrote:
> [BUG]
> A fuzzing run reproduced an unkillable io_uring task stuck at ~100% CPU:
>
> [root@fedora io_uring_stress]# ps -ef | grep io_uring
> root 1240 1 99 13:36 ? 00:01:35 [io_uring_stress] <defunct>
>
> The task loops inside io_cqring_wait() and never returns to userspace, and
> SIGKILL has no effect.
>
> [...]
Applied, thanks!
[1/1] io_uring: validate user-controlled cq.head in io_cqe_cache_refill()
commit: f44d38a31f1802b7222adaea9ee69f9d280f698a
Best regards,
--
Jens Axboe