[PATCH for-next] io_uring: use WRITE_ONCE for user shared memory

[PATCH for-next] io_uring: use WRITE_ONCE for user shared memory

[Pavel Begunkov]

IORING_SETUP_NO_MMAP rings remain user accessible even before the ctx
setup is finalised, so use WRITE_ONCE consistently when initialising
rings.

Fixes: 03d89a2de25bb ("io_uring: support for user allocated memory for rings/sqes")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
---

Mild, and no sane user should be affected, hence tareting for-next

 io_uring/io_uring.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index 3f0489261d11..f9f8ffcdad07 100644
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -3386,10 +3386,6 @@ static __cold int io_allocate_scq_urings(struct io_ring_ctx *ctx,
 
 	if (!(ctx->flags & IORING_SETUP_NO_SQARRAY))
 		ctx->sq_array = (u32 *)((char *)rings + sq_array_offset);
-	rings->sq_ring_mask = p->sq_entries - 1;
-	rings->cq_ring_mask = p->cq_entries - 1;
-	rings->sq_ring_entries = p->sq_entries;
-	rings->cq_ring_entries = p->cq_entries;
 
 	memset(&rd, 0, sizeof(rd));
 	rd.size = PAGE_ALIGN(sq_size);
@@ -3403,6 +3399,12 @@ static __cold int io_allocate_scq_urings(struct io_ring_ctx *ctx,
 		return ret;
 	}
 	ctx->sq_sqes = io_region_get_ptr(&ctx->sq_region);
+
+	memset(rings, 0, sizeof(*rings));
+	WRITE_ONCE(rings->sq_ring_mask, ctx->sq_entries - 1);
+	WRITE_ONCE(rings->cq_ring_mask, ctx->cq_entries - 1);
+	WRITE_ONCE(rings->sq_ring_entries, ctx->sq_entries);
+	WRITE_ONCE(rings->cq_ring_entries, ctx->cq_entries);
 	return 0;
 }
 
-- 
2.49.0

Re: [PATCH for-next] io_uring: use WRITE_ONCE for user shared memory

[Jens Axboe]

On Thu, 06 Nov 2025 12:58:19 +0000, Pavel Begunkov wrote:
> IORING_SETUP_NO_MMAP rings remain user accessible even before the ctx
> setup is finalised, so use WRITE_ONCE consistently when initialising
> rings.
> 
> 

Applied, thanks!

[1/1] io_uring: use WRITE_ONCE for user shared memory
      commit: 93e197e524b14d185d011813b72773a1a49d932d

Best regards,
-- 
Jens Axboe