io_uring_enter(), __io_msg_ring_data(), and io_msg_send_fd() read
ctx->flags and ctx->submitter_task without holding the ctx's uring_lock.
This means they may race with the assignment to ctx->submitter_task and
the clearing of IORING_SETUP_R_DISABLED from ctx->flags in
io_register_enable_rings(). Ensure the correct ordering of the
ctx->flags and ctx->submitter_task memory accesses by storing to
ctx->flags using release ordering and loading it using acquire ordering.

Using release-acquire ordering for IORING_SETUP_R_DISABLED ensures the
assignment to ctx->submitter_task in io_register_enable_rings() can't
race with msg_ring's accesses, so drop the unneeded {READ,WRITE}_ONCE()
and the NULL checks.

v7:
- Split from IORING_SETUP_SINGLE_ISSUER optimization series
- Drop unnecessary submitter_task {READ,WRITE}_ONCE() and NULL checks
- Drop redundant submitter_task check in io_register_enable_rings()
- Add comments explaining need for release-acquire ordering

Caleb Sander Mateos (3):
  io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED
  io_uring/msg_ring: drop unnecessary submitter_task checks
  io_uring/register: drop io_register_enable_rings() submitter_task
    check

 io_uring/io_uring.c | 13 ++++++-------
 io_uring/msg_ring.c | 28 ++++++++++++++--------------
 io_uring/register.c |  7 ++++---
 3 files changed, 24 insertions(+), 24 deletions(-)

-- 
2.45.2

On Mon, 05 Jan 2026 14:05:39 -0700, Caleb Sander Mateos wrote:
> io_uring_enter(), __io_msg_ring_data(), and io_msg_send_fd() read
> ctx->flags and ctx->submitter_task without holding the ctx's uring_lock.
> This means they may race with the assignment to ctx->submitter_task and
> the clearing of IORING_SETUP_R_DISABLED from ctx->flags in
> io_register_enable_rings(). Ensure the correct ordering of the
> ctx->flags and ctx->submitter_task memory accesses by storing to
> ctx->flags using release ordering and loading it using acquire ordering.
> 
> [...]

Applied, thanks!

[1/3] io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED
      commit: 7a8737e1132ff07ca225aa7a4008f87319b5b1ca
[2/3] io_uring/msg_ring: drop unnecessary submitter_task checks
      commit: bcd4c95737d15fa1a85152b8862dec146b11c214
[3/3] io_uring/register: drop io_register_enable_rings() submitter_task check
      commit: 130a82760718997806a618490f5b7ab06932bd9c

Best regards,
-- 
Jens Axboe

On Mon,  5 Jan 2026 14:05:39 -0700 Caleb Sander Mateos wrote:
> io_uring_enter(), __io_msg_ring_data(), and io_msg_send_fd() read
> ctx->flags and ctx->submitter_task without holding the ctx's uring_lock.
> This means they may race with the assignment to ctx->submitter_task and
> the clearing of IORING_SETUP_R_DISABLED from ctx->flags in
> io_register_enable_rings(). Ensure the correct ordering of the
> ctx->flags and ctx->submitter_task memory accesses by storing to
> ctx->flags using release ordering and loading it using acquire ordering.
> 
Given no race is erased without locking, can you specify the observable effects
without enforced ordering?

Caleb Sander Mateos <csander@purestorage.com> writes:

> io_uring_enter(), __io_msg_ring_data(), and io_msg_send_fd() read
> ctx->flags and ctx->submitter_task without holding the ctx's uring_lock.
> This means they may race with the assignment to ctx->submitter_task and
> the clearing of IORING_SETUP_R_DISABLED from ctx->flags in
> io_register_enable_rings(). Ensure the correct ordering of the
> ctx->flags and ctx->submitter_task memory accesses by storing to
> ctx->flags using release ordering and loading it using acquire ordering.
>
> Using release-acquire ordering for IORING_SETUP_R_DISABLED ensures the
> assignment to ctx->submitter_task in io_register_enable_rings() can't
> race with msg_ring's accesses, so drop the unneeded {READ,WRITE}_ONCE()
> and the NULL checks.

Hi Caleb,

This looks good, I don't have any comments.  Feel free to add:

Reviewed-by: Gabriel Krisman Bertazi <krisman@suse.de>

Thanks,

-- 
Gabriel Krisman Bertazi