[PATCH 1/1] io_uring/zcrx: init id for xa_find

[PATCH 1/1] io_uring/zcrx: init id for xa_find

[Pavel Begunkov]

xa_find() interprets id as the lower bound and thus expects it initialised.

Reported-by: syzbot+c3ff04150c30d3df0f57@syzkaller.appspotmail.com
Fixes: 76f1cc98b23ce ("io_uring/zcrx: add support for multiple ifqs")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
---
 io_uring/zcrx.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c
index 9a568d049204..0c5b7d8f8d67 100644
--- a/io_uring/zcrx.c
+++ b/io_uring/zcrx.c
@@ -630,12 +630,13 @@ int io_register_zcrx_ifq(struct io_ring_ctx *ctx,
 void io_unregister_zcrx_ifqs(struct io_ring_ctx *ctx)
 {
 	struct io_zcrx_ifq *ifq;
-	unsigned long id;
 
 	lockdep_assert_held(&ctx->uring_lock);
 
 	while (1) {
 		scoped_guard(mutex, &ctx->mmap_lock) {
+			unsigned long id = 0;
+
 			ifq = xa_find(&ctx->zcrx_ctxs, &id, ULONG_MAX, XA_PRESENT);
 			if (ifq)
 				xa_erase(&ctx->zcrx_ctxs, id);
-- 
2.49.0

Re: [PATCH 1/1] io_uring/zcrx: init id for xa_find

[Jens Axboe]

On Tue, 27 May 2025 16:27:57 +0100, Pavel Begunkov wrote:
> xa_find() interprets id as the lower bound and thus expects it initialised.
> 
> 

Applied, thanks!

[1/1] io_uring/zcrx: init id for xa_find
      commit: eda4623cf989d033c07355be1469e44f321ce8ae

Best regards,
-- 
Jens Axboe