diff options
| author | Pavel Begunkov <asml.silence@gmail.com> | 2026-02-25 13:35:57 +0300 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2026-02-25 18:36:05 +0300 |
| commit | 85f6c439a69afe4fa8a688512e586971e97e273a (patch) | |
| tree | d0762089bdd77d1b237b03775d41dabbd9fbe044 | |
| parent | a46435537a844d0f7b4b620baf962cad136422de (diff) | |
| download | linux-85f6c439a69afe4fa8a688512e586971e97e273a.tar.xz | |
io_uring/timeout: READ_ONCE sqe->addr
We should use READ_ONCE when reading from a SQE, make sure timeout gets
a stable timespec address.
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
| -rw-r--r-- | io_uring/timeout.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/io_uring/timeout.c b/io_uring/timeout.c index 84dda24f3eb2..cb61d4862fc6 100644 --- a/io_uring/timeout.c +++ b/io_uring/timeout.c @@ -462,7 +462,7 @@ int io_timeout_remove_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) tr->ltimeout = true; if (tr->flags & ~(IORING_TIMEOUT_UPDATE_MASK|IORING_TIMEOUT_ABS)) return -EINVAL; - if (get_timespec64(&tr->ts, u64_to_user_ptr(sqe->addr2))) + if (get_timespec64(&tr->ts, u64_to_user_ptr(READ_ONCE(sqe->addr2)))) return -EFAULT; if (tr->ts.tv_sec < 0 || tr->ts.tv_nsec < 0) return -EINVAL; @@ -557,7 +557,7 @@ static int __io_timeout_prep(struct io_kiocb *req, data->req = req; data->flags = flags; - if (get_timespec64(&data->ts, u64_to_user_ptr(sqe->addr))) + if (get_timespec64(&data->ts, u64_to_user_ptr(READ_ONCE(sqe->addr)))) return -EFAULT; if (data->ts.tv_sec < 0 || data->ts.tv_nsec < 0) |