io_uring/zcrx: init id for xa_find

xa_find() interprets id as the lower bound and thus expects it initialised.

Reported-by: syzbot+c3ff04150c30d3df0f57@syzkaller.appspotmail.com
Fixes: 76f1cc98b23ce ("io_uring/zcrx: add support for multiple ifqs")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/faea44ef63131e6968f635e1b6b7ca6056f1f533.1748359655.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c
index 9a568d04920470df99308d381e65bceec043982e..0c5b7d8f8d677a6a4a00d26e91f2eaad43a9ba32 100644 (file)
--- a/io_uring/zcrx.c
+++ b/io_uring/zcrx.c
@@ -630,12 +630,13 @@ ifq_free:
 void io_unregister_zcrx_ifqs(struct io_ring_ctx *ctx)
 {
        struct io_zcrx_ifq *ifq;
-       unsigned long id;
 
        lockdep_assert_held(&ctx->uring_lock);
 
        while (1) {
                scoped_guard(mutex, &ctx->mmap_lock) {
+                       unsigned long id = 0;
+
                        ifq = xa_find(&ctx->zcrx_ctxs, &id, ULONG_MAX, XA_PRESENT);
                        if (ifq)
                                xa_erase(&ctx->zcrx_ctxs, id);