From: Jens Axboe <axboe@kernel.dk>
Date: Wed, 19 Nov 2025 02:30:45 +0000 (-0700)
Subject: io_uring/register: use correct location for io_rings_layout
X-Git-Tag: v6.19-rc1~169^2~5
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f779ac0b8784858c3700f6660d606f436c62157a;p=thirdparty%2Flinux.git

io_uring/register: use correct location for io_rings_layout

A previous consolidated the ring size etc calculations into
io_prepare_config(), but missed updating io_register_resize_rings()
correctly to use the calculated values. As a result, it ended up using
on-stack uninitialized values, and hence either failed validating the
size correctly, or just failed resizing because the sizes were random.

This caused failures in the liburing regression tests:

[...]
Running test resize-rings.t
resize=-7
test_basic 3000 failed
Test resize-rings.t failed with ret 1
Running test resize-rings.t /dev/sda
resize=-7
test_basic 3000 failed
Test resize-rings.t failed with ret 1
Running test resize-rings.t /dev/nvme1n1
resize=-7
test_basic 3000 failed
Test resize-rings.t failed with ret 1
Running test resize-rings.t /dev/dm-0
resize=-7
test_basic 3000 failed
Test resize-rings.t failed with ret 1

because io_create_region() would return -E2BIG because of unintialized
reg->size values.

Adjust the struct io_rings_layout rl pointer to point to the correct
location, and remove the (now dead) __rl on stack struct.

Fixes: eb76ff6a6829 ("io_uring: pre-calculate scq layout")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
---

diff --git a/io_uring/register.c b/io_uring/register.c
index fc66a53644835..db42f98562c4e 100644
--- a/io_uring/register.c
+++ b/io_uring/register.c
@@ -403,7 +403,7 @@ static int io_register_resize_rings(struct io_ring_ctx *ctx, void __user *arg)
 	struct io_ring_ctx_rings o = { }, n = { }, *to_free = NULL;
 	unsigned i, tail, old_head;
 	struct io_uring_params *p = &config.p;
-	struct io_rings_layout __rl, *rl = &__rl;
+	struct io_rings_layout *rl = &config.layout;
 	int ret;
 
 	memset(&config, 0, sizeof(config));