Merge branch 'io_uring-7.0' into for-next

axboe · axboe · commit 58362fac7514 · 2026-03-26T20:28:37.000-06:00
* io_uring-7.0:
  io_uring/fdinfo: fix OOB read in SQE_MIXED wrap check
diff --git a/io_uring/fdinfo.c b/io_uring/fdinfo.c
@@ -119,12 +119,13 @@ static void __io_uring_show_fdinfo(struct io_ring_ctx *ctx, struct seq_file *m)
 					sq_idx);
 				break;
 			}
-			if ((++sq_head & sq_mask) == 0) {
+			if (sq_idx == sq_mask) {
 				seq_printf(m,
 					"%5u: corrupted sqe, wrapping 128B entry\n",
 					sq_idx);
 				break;
 			}
+			sq_head++;
 			i++;
 			sqe128 = true;
 		}

Original file line number	Diff line number	Diff line change
`@@ -119,12 +119,13 @@ static void __io_uring_show_fdinfo(struct io_ring_ctx ctx, struct seq_file m)`
`119`	`119`	`sq_idx);`
`120`	`120`	`break;`
`121`	`121`	`}`
`122`		`- if ((++sq_head & sq_mask) == 0) {`
	`122`	`+ if (sq_idx == sq_mask) {`
`123`	`123`	`seq_printf(m,`
`124`	`124`	`"%5u: corrupted sqe, wrapping 128B entry\n",`
`125`	`125`	`sq_idx);`
`126`	`126`	`break;`
`127`	`127`	`}`
	`128`	`+ sq_head++;`
`128`	`129`	`i++;`
`129`	`130`	`sqe128 = true;`
`130`	`131`	`}`