From: Pavel Begunkov Date: Wed, 4 Mar 2026 12:37:43 +0000 (+0000) Subject: io_uring/zcrx: use READ_ONCE with user shared RQEs X-Git-Tag: v7.0-rc3~34^2 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=531bb98a030cc1073bd7ed9a502c0a3a781e92ee;p=thirdparty%2Flinux.git io_uring/zcrx: use READ_ONCE with user shared RQEs Refill queue entries are shared with the user space, use READ_ONCE when reading them. Fixes: 34a3e60821ab9 ("io_uring/zcrx: implement zerocopy receive pp memory provider"); Cc: stable@vger.kernel.org Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe --- diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c index 19b287d21f4b..0461edebb042 100644 --- a/io_uring/zcrx.c +++ b/io_uring/zcrx.c @@ -927,11 +927,12 @@ static inline bool io_parse_rqe(struct io_uring_zcrx_rqe *rqe, struct io_zcrx_ifq *ifq, struct net_iov **ret_niov) { + __u64 off = READ_ONCE(rqe->off); unsigned niov_idx, area_idx; struct io_zcrx_area *area; - area_idx = rqe->off >> IORING_ZCRX_AREA_SHIFT; - niov_idx = (rqe->off & ~IORING_ZCRX_AREA_MASK) >> ifq->niov_shift; + area_idx = off >> IORING_ZCRX_AREA_SHIFT; + niov_idx = (off & ~IORING_ZCRX_AREA_MASK) >> ifq->niov_shift; if (unlikely(rqe->__pad || area_idx)) return false;