io_uring/waitid: fix KCSAN warning on io_waitid->head

[ Upstream commit b994ace83a2bc7699420f6a4c6b860c8da133159 ]

Storing of the iw->head entry inside the wait_queue callback, or when
removing a waitid item, really should use proper load/store
acquire/release semantics, and KCSAN correctly warns of that. Ensure
that they do so.

Reported-by: syzbot+eb441775f4f948a0902f@syzkaller.appspotmail.com
Fixes: a48c0cbf28c0 ("io_uring/waitid: have io_waitid_complete() remove wait queue entry")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/io_uring/waitid.c b/io_uring/waitid.c
index 1137e3a166d12b49822d63735eaebcf7d59cd87c..2b756017423f0ee4939ad4f081950233a55a0afa 100644 (file)
--- a/io_uring/waitid.c
+++ b/io_uring/waitid.c
@@ -114,11 +114,11 @@ static void io_waitid_remove_wq(struct io_kiocb *req)
        struct io_waitid *iw = io_kiocb_to_cmd(req, struct io_waitid);
        struct wait_queue_head *head;
 
-       head = READ_ONCE(iw->head);
+       head = smp_load_acquire(&iw->head);
        if (head) {
                struct io_waitid_async *iwa = req->async_data;
 
-               iw->head = NULL;
+               smp_store_release(&iw->head, NULL);
                spin_lock_irq(&head->lock);
                list_del_init(&iwa->wo.child_wait.entry);
                spin_unlock_irq(&head->lock);
@@ -265,7 +265,7 @@ static int io_waitid_wait(struct wait_queue_entry *wait, unsigned mode,
                return 0;
 
        list_del_init(&wait->entry);
-       iw->head = NULL;
+       smp_store_release(&iw->head, NULL);
 
        /* cancel is in progress */
        if (atomic_fetch_inc(&iw->refs) & IO_WAITID_REF_MASK)