From 360941242f09437a1e07cbed9b5a96663ffeabb6 Mon Sep 17 00:00:00 2001 From: Jens Axboe Date: Sat, 15 Aug 2026 17:53:44 -0600 Subject: [PATCH] io_uring/uring_cmd: don't skip completion for a synchronous multishot cmd If IORING_URING_CMD_MULTISHOT is set, io_uring_cmd() treats any non-negative return from ->uring_cmd() as the driver having taken ownership of the request and returns IOU_ISSUE_SKIP_COMPLETE. But nothing guarantees that the driver did so, and any handler that just completes the command inline and returns 0 or a positive result then leaves the request orphaned, leaking the io_kiocb, the async data, and the file reference. The special case isn't needed. ublk returns -EIOCBQUEUED for the multishot fetch command, which is passed through as-is, and the poll driven socket timestamp command returns -EAGAIN. Kill it, a multishot handler that wants to hang on to the request must return -EIOCBQUEUED or -EAGAIN like any other command. Fixes: 620a50c92700 ("io_uring: uring_cmd: add multishot support") Cc: stable@vger.kernel.org Reported-by: syzbot+a4ccdd7ebf452e4d4701@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/6a7a0194.b50370da.49fe0.0056.GAE@google.com/ Link: https://lore.kernel.org/all/20260811115125.1831170-1-vasilisalmpanis@gmail.com/ Signed-off-by: Jens Axboe --- io_uring/uring_cmd.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/io_uring/uring_cmd.c b/io_uring/uring_cmd.c index ea1432251ccf..0642995ac3f6 100644 --- a/io_uring/uring_cmd.c +++ b/io_uring/uring_cmd.c @@ -273,10 +273,6 @@ int io_uring_cmd(struct io_kiocb *req, unsigned int issue_flags) } ret = file->f_op->uring_cmd(ioucmd, issue_flags); - if (ioucmd->flags & IORING_URING_CMD_MULTISHOT) { - if (ret >= 0) - return IOU_ISSUE_SKIP_COMPLETE; - } if (ret == -EAGAIN) { ioucmd->flags |= IORING_URING_CMD_REISSUE; return ret;