This is a note to let you know that I've just added the patch titled io_uring: fix fdinfo sqe offsets calculation to the 6.0-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: io_uring-fix-fdinfo-sqe-offsets-calculation.patch and it can be found in the queue-6.0 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 00927931cb630bbf8edb6d7f4dadb25139fc5e16 Mon Sep 17 00:00:00 2001 From: Pavel Begunkov <asml.silence@xxxxxxxxx> Date: Tue, 11 Oct 2022 01:59:57 +0100 Subject: io_uring: fix fdinfo sqe offsets calculation From: Pavel Begunkov <asml.silence@xxxxxxxxx> commit 00927931cb630bbf8edb6d7f4dadb25139fc5e16 upstream. Only with the big sqe feature they take 128 bytes per entry, but we unconditionally advance by 128B. Fix it by using sq_shift. Fixes: 3b8fdd1dc35e3 ("io_uring/fdinfo: fix sqe dumping for IORING_SETUP_SQE128") Reported-and-tested-by: syzbot+e5198737e8a2d23d958c@xxxxxxxxxxxxxxxxxxxxxxxxx Signed-off-by: Pavel Begunkov <asml.silence@xxxxxxxxx> Link: https://lore.kernel.org/r/8b41287cb75d5efb8fcb5cccde845ddbbadd8372.1665449983.git.asml.silence@xxxxxxxxx Signed-off-by: Jens Axboe <axboe@xxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- io_uring/fdinfo.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/io_uring/fdinfo.c +++ b/io_uring/fdinfo.c @@ -95,7 +95,7 @@ static __cold void __io_uring_show_fdinf sq_idx = READ_ONCE(ctx->sq_array[entry & sq_mask]); if (sq_idx > sq_mask) continue; - sqe = &ctx->sq_sqes[sq_idx << 1]; + sqe = &ctx->sq_sqes[sq_idx << sq_shift]; seq_printf(m, "%5u: opcode:%s, fd:%d, flags:%x, off:%llu, " "addr:0x%llx, rw_flags:0x%x, buf_index:%d " "user_data:%llu", Patches currently in stable-queue which might be from asml.silence@xxxxxxxxx are queue-6.0/io_uring-net-don-t-update-msg_name-if-not-provided.patch queue-6.0/io_uring-rw-fix-unexpected-link-breakage.patch queue-6.0/io_uring-rw-don-t-lose-short-results-on-io_setup_async_rw.patch queue-6.0/io_uring-add-custom-opcode-hooks-on-fail.patch queue-6.0/io_uring-net-fix-notif-cqe-reordering.patch queue-6.0/io_uring-correct-pinned_vm-accounting.patch queue-6.0/io_uring-net-rename-io_sendzc.patch queue-6.0/io_uring-af_unix-defer-registered-files-gc-to-io_uring-release.patch queue-6.0/io_uring-net-refactor-io_sr_msg-types.patch queue-6.0/io_uring-net-don-t-lose-partial-send-recv-on-fail.patch queue-6.0/io_uring-net-don-t-lose-partial-send_zc-on-fail.patch queue-6.0/io_uring-net-don-t-skip-notifs-for-failed-requests.patch queue-6.0/io_uring-fix-fdinfo-sqe-offsets-calculation.patch queue-6.0/io_uring-rw-don-t-lose-partial-io-result-on-fail.patch queue-6.0/io_uring-limit-registration-w-single_issuer.patch queue-6.0/io_uring-fix-cqe-reordering.patch queue-6.0/io_uring-net-fix-fast_iov-assignment-in-io_setup_async_msg.patch queue-6.0/io_uring-net-use-io_sr_msg-for-sendzc.patch