io_uring/query: prevent infinite loops

If the query chain forms a cycle, the interface will loop indefinitely.
Make sure it handles fatal signals, so the user can kill the process and
hence break out of the infinite loop.

Fixes: c265ae75f9 ("io_uring: introduce io_uring querying")
Reported-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
pull/1354/merge
Pavel Begunkov 2025-09-19 12:11:56 +01:00 committed by Jens Axboe
parent 31bf77dcc3
commit 2408d17832
1 changed files with 4 additions and 0 deletions

View File

@ -88,6 +88,10 @@ int io_query(struct io_ring_ctx *ctx, void __user *arg, unsigned nr_args)
if (ret)
return ret;
uhdr = u64_to_user_ptr(next_hdr);
if (fatal_signal_pending(current))
return -EINTR;
cond_resched();
}
return 0;
}