linux-kernel - Re: [BUG] soft lockup in seq_read while reading io

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <7fdc9f43-9ee6-4fcf-a44b-06ceb7a2db32@kernel.dk>
Date: Tue, 3 Feb 2026 09:59:18 -0700
From: Jens Axboe <axboe@...nel.dk>
To: 是参差 <shicenci@...il.com>,
 io-uring <io-uring@...r.kernel.org>
Cc: "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [BUG] soft lockup in seq_read while reading io_uring fdinfo

On 2/3/26 2:39 AM, ??? wrote:
> Hi,
> 
> I?m reporting a reproducible soft lockup observed in the seq_file read path when reading io_uring fdinfo via procfs.
> 
> The lockup is triggered by a syzkaller C reproducer that:
> 
> creates an io_uring instance with a large number of entries, and then
> 
> reads /proc/thread-self/fdinfo/<uring_fd>.
> 
> The watchdog reports a soft lockup with CPU stuck in __sanitizer_cov_trace_pc() while the task is executing seq_read() -> io_uring_show_fdinfo().

It's feeding invalid cq ring head/tail entries, so it'll loop for
potentially quite a long time, particularly with debugging measures
enabled. This should sort it out:


diff --git a/io_uring/fdinfo.c b/io_uring/fdinfo.c
index 4f12e98b22c3..74ea0d965d78 100644
--- a/io_uring/fdinfo.c
+++ b/io_uring/fdinfo.c
@@ -67,7 +67,7 @@ static void __io_uring_show_fdinfo(struct io_ring_ctx *ctx, struct seq_file *m)
 	unsigned int cq_head = READ_ONCE(r->cq.head);
 	unsigned int cq_tail = READ_ONCE(r->cq.tail);
 	unsigned int sq_shift = 0;
-	unsigned int sq_entries;
+	unsigned int cq_entries, sq_entries;
 	int sq_pid = -1, sq_cpu = -1;
 	u64 sq_total_time = 0, sq_work_time = 0;
 	unsigned int i;
@@ -146,13 +146,15 @@ static void __io_uring_show_fdinfo(struct io_ring_ctx *ctx, struct seq_file *m)
 			}
 		}
 		seq_printf(m, "\n");
+		cond_resched();
 	}
 	seq_printf(m, "CQEs:\t%u\n", cq_tail - cq_head);
-	while (cq_head < cq_tail) {
+	cq_entries = min(cq_tail - cq_head, ctx->sq_entries);
+	for (i = 0; i < cq_entries; i++) {
 		struct io_uring_cqe *cqe;
 		bool cqe32 = false;
 
-		cqe = &r->cqes[(cq_head & cq_mask)];
+		cqe = &r->cqes[((cq_head + i) & cq_mask)];
 		if (cqe->flags & IORING_CQE_F_32 || ctx->flags & IORING_SETUP_CQE32)
 			cqe32 = true;
 		seq_printf(m, "%5u: user_data:%llu, res:%d, flags:%x",
@@ -165,6 +167,7 @@ static void __io_uring_show_fdinfo(struct io_ring_ctx *ctx, struct seq_file *m)
 		cq_head++;
 		if (cqe32)
 			cq_head++;
+		cond_resched();
 	}
 
 	if (ctx->flags & IORING_SETUP_SQPOLL) {

-- 
Jens Axboe