Horton

Thread

Commits

  1. aio: io_uring: Fix danger of completion getting reused before being read

  1. io_uring: Fix danger of completion getting reused before being read

    Andres Freund <andres@anarazel.de> — 2026-01-15T15:38:43Z

    Hi,

I privately got a report about a bug in method_io_uring.c:

We are calling io_uring_cqe_seen(..., cqe) before reading cqe->res. That
allows the completion to be reused, which in turn could lead to cqe->res being
overwritten. The window for that is very narrow and the likelihood of it
happening is very low, as we should never actually utilize all CQEs, but the
consequences would be bad.

I plan to push the fix soon-ish.

Greetings,

Andres Freund

  2. Re: io_uring: Fix danger of completion getting reused before being read

    Kirill Reshke <reshkekirill@gmail.com> — 2026-01-15T18:53:56Z

    On Thu, 15 Jan 2026 at 20:38, Andres Freund <andres@anarazel.de> wrote:
>
> Hi,
>
> I privately got a report about a bug in method_io_uring.c:
>
> We are calling io_uring_cqe_seen(..., cqe) before reading cqe->res. That
> allows the completion to be reused, which in turn could lead to cqe->res being
> overwritten. The window for that is very narrow and the likelihood of it
> happening is very low, as we should never actually utilize all CQEs, but the
> consequences would be bad.
>
> I plan to push the fix soon-ish.
>
> Greetings,
>
> Andres Freund

I see this is already committed as 807764990. Just pointing in case
somebody wants to review.


-- 
Best regards,
Kirill Reshke