[v1] io_uring/cmd: don't skip completion for a non-armed multishot uring_cmd

io_uring/cmd: don't skip completion for a non-armed multishot uring_cmd

Posted by Vasileios Almpanis 1 month, 2 weeks ago

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 06cf61899d6498b33e4b7c87d99d5bd471ccc375

diff --git a/io_uring/uring_cmd.c b/io_uring/uring_cmd.c
index c14c22cff49e..a2899a852879 100644
--- a/io_uring/uring_cmd.c
+++ b/io_uring/uring_cmd.c
@@ -269,7 +269,8 @@ int io_uring_cmd(struct io_kiocb *req, unsigned int issue_flags)
 	}
 
 	ret = file->f_op->uring_cmd(ioucmd, issue_flags);
-	if (ioucmd->flags & IORING_URING_CMD_MULTISHOT) {
+	if ((ioucmd->flags & IORING_URING_CMD_MULTISHOT) &&
+	    (req->flags & REQ_F_APOLL_MULTISHOT)) {
 		if (ret >= 0)
 			return IOU_ISSUE_SKIP_COMPLETE;
 	}

Re: [syzbot] [io-uring?] [block?] memory leak in io_submit_sqes (6)

Posted by syzbot 1 month, 2 weeks ago

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+a4ccdd7ebf452e4d4701@syzkaller.appspotmail.com
Tested-by: syzbot+a4ccdd7ebf452e4d4701@syzkaller.appspotmail.com

Tested on:

commit:         06cf6189 Merge tag 'x86-urgent-2026-08-08' of git://gi..
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=158ce149580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=6843f8fd2336602d
dashboard link: https://syzkaller.appspot.com/bug?extid=a4ccdd7ebf452e4d4701
compiler:       gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
patch:          https://syzkaller.appspot.com/x/patch.diff?x=17e19879580000

Note: testing is done by a robot and is best-effort only.