Re: [PATCH] io_uring/waitid: prevent cancel reference wrap

[Jens Axboe]

On Tue, 20 Oct 2026 00:21:00 +0900, Junyeong Lee wrote:
> io_waitid packs the cancellation state into bit 31 of ->refs and
> uses bits 30:0 as a 31-bit reference counter:
> 
>   #define IO_WAITID_CANCEL_FLAG BIT(31)
>   #define IO_WAITID_REF_MASK    GENMASK(30, 0)
> 
> __io_waitid_cancel() marks a request canceled, then increments the low
> bits of ->refs to claim completion ownership. When another path owns the
> request, the increment remains even though cancellation returns false.
> The request remains discoverable by cancellation, so repeated failed
> attempts can wrap the 31-bit reference field to zero. A later cancellation
> can claim ownership and complete the request a second time.
> 
> [...]

Applied, thanks!

[1/1] io_uring/waitid: prevent cancel reference wrap
      commit: 98787d3fa4e99564d2b2bc21255b21f670c450d0

Best regards,
-- 
Jens Axboe