io_uring/wait: fix min_timeout behavior

The wakeup condition if a min timeout is present and has expired is that
at least _one_ CQE was posted. Thus set the cq_tail target to
->cq_min_tail + 1. Without this commit a spurious wakeup can result in a
premature wakeup because io_should_wake() will return true even if _no_
CQE was posted at all.

Cc: Tip ten Brink <tip@tenbrinkmeijs.com>
Fixes: e15cb2200b93 ("io_uring: fix min_wait wakeups for SQPOLL")
Cc: stable@vger.kernel.org
Signed-off-by: Christian A. Ehrhardt <lk@c--e.de>
Link: https://patch.msgid.link/20260606201120.1441447-1-lk@c--e.de
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/io_uring/wait.c b/io_uring/wait.c
index ec01e78a216d6c0640fbfa382c8abcc2f6b23fc6..d005ea17b35f46638d7d5b22854dac23d74f9a19 100644 (file)
--- a/io_uring/wait.c
+++ b/io_uring/wait.c
@@ -103,7 +103,7 @@ static enum hrtimer_restart io_cqring_min_timer_wakeup(struct hrtimer *timer)
        }
 
        /* any generated CQE posted past this time should wake us up */
-       iowq->cq_tail = iowq->cq_min_tail;
+       iowq->cq_tail = iowq->cq_min_tail + 1;
 
        hrtimer_update_function(&iowq->t, io_cqring_timer_wakeup);
        hrtimer_set_expires(timer, iowq->timeout);