Re: [PATCH V2] io_uring: validate user-controlled cq.head in io_cqe_cache_refill()

On 5/13/26 8:18 PM, Zizhi Wo wrote:
> From: Zizhi Wo <[email protected]>
> 
> [BUG]
> A fuzzing run reproduced an unkillable io_uring task stuck at ~100% CPU:
> 
>     [root@fedora io_uring_stress]# ps -ef | grep io_uring
>     root  1240  1  99 13:36 ?  00:01:35 [io_uring_stress] <defunct>
> 
> The task loops inside io_cqring_wait() and never returns to userspace, and
> SIGKILL has no effect.

Thanks - applied with a few edits, see final result here:

https://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux.git/commit/?h=io_uring-7.1&id=f44d38a31f1802b7222adaea9ee69f9d280f698a

The comments (and commit message) read very LLM'ish, so dialed that back
a bit. And there's no reason to put io_cqring_queued() in a header file
when it's only used in io_uring.c. And finally, the 'queued' variable is
now useless, so kill that too.

-- 
Jens Axboe