From c905736a46892e4776efc7f50888d67715d6ec08 Mon Sep 17 00:00:00 2001 From: Robert Femmer Date: Wed, 24 Jun 2026 11:01:46 +0200 Subject: io_uring: annotate remote tasks for kcoverage Fuzzers use coverage information to guide generation of test cases towards new or interesting code paths. Syzkaller, specifically, makes use kcoverage (CONFIG_KCOV). Coverage information is not collected for kernel tasks unless annotated by kcov_remote_start and kcov_remote_stop. This patch annotates io-uring's work queue and sqpoll tasks. Depends-On: 20260430-kcov-refactor-common-handle-v1-1-23a0c7a0ba38@google.com Signed-off-by: Robert Femmer Signed-off-by: Jens Axboe --- include/linux/io_uring_types.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include/linux') diff --git a/include/linux/io_uring_types.h b/include/linux/io_uring_types.h index 87151a5b62c1..a2c623a67a25 100644 --- a/include/linux/io_uring_types.h +++ b/include/linux/io_uring_types.h @@ -534,6 +534,8 @@ struct io_ring_ctx { struct io_mapped_region ring_region; /* used for optimised request parameter and wait argument passing */ struct io_mapped_region param_region; + + struct kcov_common_handle_id kcov_handle; }; /* -- cgit v1.2.3 From cd305ee3633a45fcf5f3a5d83f99f3cb77d87b6e Mon Sep 17 00:00:00 2001 From: Jens Axboe Date: Fri, 14 Aug 2026 06:58:43 -0600 Subject: io_uring: defer eventfd signaling when queued from a wakeup handler io_req_local_work_add() signals the CQ ring eventfd inline when it is the one to push the first entry onto ->work_list. For DEFER_TASKRUN rings that add is frequently done from a waitqueue wakeup handler, where an arbitrary waitqueue lock is held. eventfd_signal_mask() only refuses to recurse when current->in_eventfd is set, but that bit is set by eventfd_signal_mask() itself. If the wake chain starts somewhere else, signal goes out inline and can feed back into epoll. Add IOU_F_TWQ_IN_WAKE, set it on the task_work add done from the three waitqueue callbacks, and use it to force io_eventfd_signal() down the existing call_rcu_hurry() deferral instead of signaling inline. Fixes: 21a091b970cd ("io_uring: signal registered eventfd to process deferred task work") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/20260813133843.2933127-1-4ncienth@gmail.com/ Signed-off-by: Jens Axboe --- include/linux/io_uring_types.h | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'include/linux') diff --git a/include/linux/io_uring_types.h b/include/linux/io_uring_types.h index a2c623a67a25..f6e90cc64a1f 100644 --- a/include/linux/io_uring_types.h +++ b/include/linux/io_uring_types.h @@ -20,6 +20,14 @@ enum { * It's also ignored unless IORING_SETUP_DEFER_TASKRUN is set. */ IOU_F_TWQ_LAZY_WAKE = 1, + + /* + * Set when task_work is queued from a waitqueue wakeup handler, where + * an arbitrary provider waitqueue lock is held. Signaling the CQ ring + * eventfd inline from there can recurse back into that lock through + * epoll, so the eventfd signal must be deferred. + */ + IOU_F_TWQ_IN_WAKE = 2, }; enum io_uring_cmd_flags { -- cgit v1.2.3 From 881dc9dd66d2367e7fe1be0f953a8837cb3b26a9 Mon Sep 17 00:00:00 2001 From: Mark Brown Date: Tue, 18 Aug 2026 19:41:34 +0100 Subject: io_uring: Add missing include for ITER_SOURCE and ITER_DEST Fix IWYU issues: /tmp/next/build/include/linux/io_uring_types.h:56:32: error: 'ITER_DEST' undeclared here (not in a function) 56 | IO_BUF_DEST = 1 << ITER_DEST, | ^~~~~~~~~ /tmp/next/build/include/linux/io_uring_types.h:57:32: error: 'ITER_SOURCE' undeclared here (not in a function) 57 | IO_BUF_SOURCE = 1 << ITER_SOURCE, | ^~~~~~~~~~~ Fixes: 95961b72c57b2 ("io_uring/rsrc: rename and export IO_IMU_DEST / IO_IMU_SOURCE") Signed-off-by: Mark Brown Link: https://patch.msgid.link/20260818184134.384991-1-broonie@kernel.org Signed-off-by: Jens Axboe --- include/linux/io_uring_types.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include/linux') diff --git a/include/linux/io_uring_types.h b/include/linux/io_uring_types.h index f6e90cc64a1f..94936ee297ef 100644 --- a/include/linux/io_uring_types.h +++ b/include/linux/io_uring_types.h @@ -6,6 +6,7 @@ #include #include #include +#include #include struct iou_loop_params; -- cgit v1.2.3