Merge tag 'io_uring-7.0-20260327' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

torvalds · torvalds · commit 196ef74abd3a · 2026-03-27T15:35:38.000-07:00
Pull io_uring fixes from Jens Axboe:
 "Just two small fixes, both fixing regressions added in the fdinfo code
  in 6.19 with the SQE mixed size support"

* tag 'io_uring-7.0-20260327' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  io_uring/fdinfo: fix OOB read in SQE_MIXED wrap check
  io_uring/fdinfo: fix SQE_MIXED SQE displaying
diff --git a/io_uring/fdinfo.c b/io_uring/fdinfo.c
@@ -119,12 +119,14 @@ static void __io_uring_show_fdinfo(struct io_ring_ctx *ctx, struct seq_file *m)
 					sq_idx);
 				break;
 			}
-			if ((++sq_head & sq_mask) == 0) {
+			if (sq_idx == sq_mask) {
 				seq_printf(m,
 					"%5u: corrupted sqe, wrapping 128B entry\n",
 					sq_idx);
 				break;
 			}
+			sq_head++;
+			i++;
 			sqe128 = true;
 		}
 		seq_printf(m, "%5u: opcode:%s, fd:%d, flags:%x, off:%llu, "

Original file line number	Diff line number	Diff line change
`@@ -119,12 +119,14 @@ static void __io_uring_show_fdinfo(struct io_ring_ctx ctx, struct seq_file m)`
`119`	`119`	`sq_idx);`
`120`	`120`	`break;`
`121`	`121`	`}`
`122`		`- if ((++sq_head & sq_mask) == 0) {`
	`122`	`+ if (sq_idx == sq_mask) {`
`123`	`123`	`seq_printf(m,`
`124`	`124`	`"%5u: corrupted sqe, wrapping 128B entry\n",`
`125`	`125`	`sq_idx);`
`126`	`126`	`break;`
`127`	`127`	`}`
	`128`	`+ sq_head++;`
	`129`	`+ i++;`
`128`	`130`	`sqe128 = true;`
`129`	`131`	`}`
`130`	`132`	`seq_printf(m, "%5u: opcode:%s, fd:%d, flags:%x, off:%llu, "`