]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
io_uring/tctx: mark io_wq as exiting before error path teardown
authorJens Axboe <axboe@kernel.dk>
Thu, 16 Apr 2026 16:05:41 +0000 (10:05 -0600)
committerJens Axboe <axboe@kernel.dk>
Mon, 20 Apr 2026 20:47:37 +0000 (14:47 -0600)
commit41859843f27dd5c8d3bc43489ad9196c96d39f2b
treee2f0d29a02e099c7bb3c230222eccc07c0a1d2e7
parentee5417fd02cabb6235a89daf5142ffde9aa957fd
io_uring/tctx: mark io_wq as exiting before error path teardown

syzbot reports that it's hitting the below condition for exiting an
io_wq context:

WARN_ON_ONCE(!test_bit(IO_WQ_BIT_EXIT, &wq->state))

in io_wq_put_and_exit(), which can be triggered with memory allocation
fault injection. Ensure that the io_wq is marked as exiting to silence
this warning trigger.

Reported-by: syzbot+79a4cc863a8db58cd92b@syzkaller.appspotmail.com
Fixes: 7880174e1e5e ("io_uring/tctx: clean up __io_uring_add_tctx_node() error handling")
Reviewed-by: Clément Léger <cleger@meta.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
io_uring/tctx.c