7:46.611Z","sessionId":"faa0c55e-a59b-41fd-82ad-e9be489dbb09","cwd":"/home/josie/development/josiedot/health"} {"debug":"Tool 'getDiagnostics' completed successfully in 5ms","timestamp":"2025-12-22T21:27:46.616Z","sessionId":"faa0c55e-a59b-41fd-82ad-e9be489dbb09","cwd":"/home/josie/development/josiedot/health"} {"debug":"Calling MCP tool: getDiagnostics","timestamp":"2025-12-22T21:27:46.665Z","sessionId":"faa0c55e-a59b-41fd-82ad-e9be489dbb09","cwd":"/home/josie/development/josiedot/health"} {"debug":"Tool 'getDiagnostics' completed successfully in 3ms","timestamp":"2025-12-22T21:27:46.668Z","sessionId":"faa0c55e-a59b-41fd-82ad-e9be489dbb09","cwd":"/home/josie/development/josiedot/health"} {"debug":"Calling MCP tool: getDiagnostics","timestamp":"2025-12-22T21:28:01.973Z","sessionId":"faa0c55e-a59b-41fd-82ad-e9be489dbb09","cwd":"/home/josie/development/josiedot/health"} {"debug":"Tool 'getDiagnostics' completed successfully in 7ms","timestamp":"2025-12-22T21:28:01.981Z","sessionId":"faa0c55e-a59b-41fd-82ad-e9be489dbb09","cwd":"/home/josie/development/josiedot/health"} {"debug":"Calling MCP tool: getDiagnostics","timestamp":"2025-12-22T21:28:02.081Z","sessionId":"faa0c55e-a59b-41fd-82ad-e9be489dbb09","cwd":"/home/josie/development/josiedot/health"} {"debug":"Tool 'getDiagnostics' completed successfully in 5ms","timestamp":"2025-12-22T21:28:02.086Z","sessionId":"faa0c55e-a59b-41fd-82ad-e9be489dbb09","cwd":"/home/josie/development/josiedot/health"} {"debug":"Calling MCP tool: getDiagnostics","timestamp":"2025-12-22T21:28:08.596Z","sessionId":"faa0c55e-a59b-41fd-82ad-e9be489dbb09","cwd":"/home/josie/development/josiedot/health"} {"debug":"Tool 'getDiagnostics' completed successfully in 5ms","timestamp":"2025-12-22T21:28:08.601Z","sessionId":"faa0c55e-a59b-41fd-82ad-e9be489dbb09","cwd":"/home/josie/development/josiedot/health"} {"debug":"Calling MCP tool: getDiagnostics","timestamp":"2025-12-22T21:29:36.217Z","sessionId":"faa0c55e-a59b-41fd-82ad-e9be489dbb09","cwd":"/home/josie/development/josiedot/health"} {"debug":"Tool 'getDiagnostics' completed successfully in 13ms","timestamp":"2025-12-22T21:29:36.230Z","sessionId":"faa0c55e-a59b-41fd-82ad-e9be489dbb09","cwd":"/home/josie/development/josiedot/health"} {"debug":"Calling MCP tool: getDiagnostics","timestamp":"2025-12-22T21:29:51.154Z","sessionId":"faa0c55e-a59b-41fd-82ad-e9be489dbb09","cwd":"/home/josie/development/josiedot/health"} {"debug":"Tool 'getDiagnostics' completed successfully in 4ms","timestamp":"2025-12-22T21:29:51.158Z","sessionId":"faa0c55e-a59b-41fd-82ad-e9be489dbb09","cwd":"/home/josie/development/josiedot/health"} {"debug":"Calling MCP tool: getDiagnostics","timestamp":"2025-12-22T21:29:51.203Z","sessionId":"faa0c55e-a59b-41fd-82ad-e9be489dbb09","cwd":"/home/josie/development/josiedot/health"} {"debug":"Tool 'getDiagnostics' completed successfully in 11ms","timestamp":"2025-12-22T21:29:51.214Z","sessionId":"faa0c55e-a59b-41fd-82ad-e9be489dbb09","cwd":"/home/josie/development/josiedot/health"} {"debug":"Calling MCP tool: getDiagnostics","timestamp":"2025-12-22T21:30:00.993Z","sessionId":"faa0c55e-a59b-41fd-82ad-e9be489dbb09","cwd":"/home/josie/development/josiedot/health"} {"debug":"Tool 'getDiagnostics' completed successfully in 4ms","timestamp":"2025-12-22T21:30:00.997Z","sessionId":"faa0c55e-a59b-41fd-82ad-e9be489dbb09","cwd":"/home/josie/development/josiedot/health"} {"debug":"Calling MCP tool: getDiagnostics","timestamp":"2025-12-22T21:30:01.044Z","sessionId":"faa0c55e-a59b-41fd-82ad-e9be489dbb09","cwd":"/home/josie/development/josiedot/health"} {"debug":"Tool 'getDiagnostics' completed successfully in 1ms","timestamp":"2025-12-22T21:30:01.045Z","sessionId":"faa0c55e-a59b-41fd-82ad-e9be489dbb09","cwd":"/home/josie/development/josiedot/health"} {"debug":"Calling MCP tool: getDiagnostics","timestamp":"2025-12-22T21:30:13.648Z","sessionId":"faa0c55e-a59b-41fd-82ad-e9be489dbb09","cwd":"/home/josie/development/josiedot/health"} {"debug":"Tool 'getDiagnostics' completed successfully in 3ms","timestamp":"2025-12-22T21:30:13.651Z","sessionId":"faa0c55e-a59b-41fdessage-ID:In-Reply-To:References: MIME-Version; b=QgmcnD0pqJbjIsyRm07AHfmb0DsZMFOipWDJKUjuVlBG9iRDXYDt6PuyX6Tt7eSDjyIDXujPLR43WSOTkwnfx1sPS4/RtImiiwLMQPNswxaf4j0O5lWDfGV9EwlDxkR7V0T5nh6B+WBNhbxJu0NJKwu7e9uy3Fm68nJ89YbHDQI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=YH1Buoku; arc=none smtp.client-ip=209.85.208.50 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Received: by mail-ed1-f50.google.com with SMTP id 4fb4d7f45d1cf-65c01595082so9769911a12.3 for ; Wed, 25 Feb 2026 02:36:09 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1772015768; x=1772620568; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=+f9OUhtk1Jt/f2+uHK+M/WGDZ/ktGjugV2mUmuZLtkE=; b=YH1BuokudBwL18hHlzb6CfgStzhzo2n+uUDboDhUIEf58VM8F2yrX2uzDQ2TCTLSMQ T8UFHxH05Y+AAfwcSydGcR/0IpZ5kHE1mFTBLVCjR6veg3Mm90YGmGi4JvCP7nlTq0PL MQdJw0hYsB41WMQtG2gx2yY3njBT/OFg9u06yKd4xSWICTmjX9qrK223f50ea/Qod5eR 7M6v7BX4uEHv2CSmnNafi3heO4Fa/5TgHdGdDQqL7UzA/EBu/DK0RHf3CWCwx/uVMd8Z wsXE6mDWeKJpteLYoWIz3yx8I244qzoKe67aUuphF6POIZXfHeWcK6P7onhJflGkWn6v GTYA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1772015768; x=1772620568; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=+f9OUhtk1Jt/f2+uHK+M/WGDZ/ktGjugV2mUmuZLtkE=; b=B0DqKDg4IzL8QojIyaWBMdUsGl6SFBLT8zoYUmE7L/IFxFXMT/RgDi0PZjCJyDn/8l sP85TzOBRkJGmasSVnWe4/4rYj9juFNRlvGS6MMOK9mIwd/MWZZfSPkUYf4txGjrpDwg u91KKlcibnZTFVWUQI1HgdRIHCHEzsR8OBB762nDKRYmgdHrIfdoytkBDm58Go85NE4T 4l+VHJjpFtdUZ+CEyOWlQqs8SCIWsGLwvDJnbBRaFXUPl1heg4pX7MyFHWXH01nsCjl5 SPH4xw38vF7H9bR1IExc/+BQoY8g9Ln5mHrTAXxMJfL9APxFyYSlyApZx25O3yXXWwLo W3Ag== X-Gm-Message-State: AOJu0YztKPQ5CdWixh4Rm2rnN46U3cqNtE4WePSJ9SIickgczhKFWmqX J3cIKGhJG9QrojtTLk6NIIPvTS0KUejm9PphVZ5iO9083CXh4fG0y011R6NWyQ== X-Gm-Gg: ATEYQzw42nP3sjyaffqkn0Vs53fNnWvJmOS6lGCl2HxhNNGnr/lQit1PegItDuzMYnw VDriNH6ViD9+Ci4ly1Kwz55Z1MWIDIWUuYIUrBJUGl4hlNpcSh3pbQm47EbV3icp/jqZVnbuJsE eG5uUOD4Mt49Ob4y8GHZlkIlkHGrG44LUU0L/0jNIdRBSkrFo5QtQLE/w9nUGRIZIWJMHZEN3lm VOjYwIekhVn2ipVTn8uEHVJvIJwEiH10FQcAtrYetSMA3FpcQQ+L3aLDwZ9Vu2gWl4SbT5617Nt 17+nRZX03RxR7y5MhEHp3zwBDyZzoSfywVmVANhCuEA7wfKJsp8MsxR/cOA+ylugnRSl9s9Jzc1 E5wzvv5OZMETqoMxgIfBfVy4DxF3PLBGNzdPR8lNV073KpdNtW6E2xLirwJOH5fbmPqn9UIgSOp mbzaavKoJKUNvS2SZ0Vk9zsx6sHXRpHQnA6HXyBcbI7kAWgrP2uMfSXTNkZqqHMjDqDgRZvKE70 towGCNXVVXLlq4jcLi8ZPI0/QoiEd27vTL7tHNFoV7S9sbmJP/2eRcWhH2I X-Received: by 2002:a17:906:209c:b0:b87:1590:d528 with SMTP id a640c23a62f3a-b9081b6d72cmr594311866b.40.1772015767307; Wed, 25 Feb 2026 02:36:07 -0800 (PST) Received: from 127.0.0.1localhost (82-132-214-161.dab.02.net. [82.132.214.161]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-b9084c82495sm500530666b.20.2026.02.25.02.36.06 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 25 Feb 2026 02:36:06 -0800 (PST) From: Pavel Begunkov To: io-uring@vger.kernel.org Cc: asml.silence@gmail.com, axboe@kernel.dk, Keith Busch Subject: [PATCH v2 2/2] io_uring/timeout: immediate timeout arg Date: Wed, 25 Feb 2026 10:35:58 +0000 Message-ID: <6151302f1dc01d1c4e3176da50ab4224947b709f.1772015321.git.asml.silence@gmail.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: io-uring@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-DKIM: signer='gmail.com' status='pass' reason='' DKIMCheck: Server passes DKIM test, 0 Spam score X-Spam-Score: 0.4 (/) X-Spam-Report: Spam detection software, running on the system "witcher.mxrouting.net", has performed the tests listed below against this email. Information: https://docs.mxroute.com/docs/expert-spam-filtering.html --- Content analysis details: (0.4 points) --- pts rule name description ---- ---------------------- ----------------------------------------- 0.0 RCVD_IN_ZEN_BLOCKED_OPENDNS RBL: ADMINISTRATOR NOTICE: The query to zen.spamhaus.org was blocked due to usage of an open resolver. See https://www.spamhaus.org/returnc/pub/ [172.234.253.10 listed in zen.spamhaus.org] 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider [asml.silence[at]gmail.com] 0.0 RCVD_IN_DNSWL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to DNSWL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block for more information. [172.234.253.10 listed in list.dnswl.org] 1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature 0.0 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom freemail headers are different -1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list manager SpamTally: Final spam score: 4 One the things the user has always keep in mind is that any user pointers they put into an SQE is not going to be read by the kernel until submission happens, and the user has to ensure the pointee stays alive until then. For example, this snippet: void prep_timeout(struct io_uring_sqe *sqe) { struct __kernel_timespec ts = {...}; prep_timeout(sqe, &ts); } void submit() { sqe = get_sqe(); prep_timeout(sqe); io_uring_submit(); } would lead to UAF for the on stack variable 'ts'. Instead of passing the timeout value as a pointer allow to store it immediately in the SQE. The user has to set a new flag called IORING_TIMEOUT_IMMEDIATE_ARG, in which case sqe->addr will be interpreted as the timeout value in ns. It only works with relative timeouts and rejected if set together with IORING_TIMEOUT_ABS out of concerns of not having enough range in u64 to represent a good long term API. Signed-off-by: Pavel Begunkov --- include/uapi/linux/io_uring.h | 5 +++++ io_uring/timeout.c | 28 +++++++++++++++++++++++----- 2 files changed, 28 insertions(+), 5 deletions(-) diff --git a/include/uapi/linux/io_uring.h b/include/uapi/linux/io_uring.h index 6750c383a2ab..8f4de786e6e9 100644 --- a/include/uapi/linux/io_uring.h +++ b/include/uapi/linux/io_uring.h @@ -340,6 +340,10 @@ enum io_uring_op { /* * sqe->timeout_flags + * + * IORING_TIMEOUT_IMMEDIATE_ARG: If set, sqe->addr stores the timeout + * value in nanoseconds instead of + * pointing to a timespec. */ #define IORING_TIMEOUT_ABS (1U << 0) #define IORING_TIMEOUT_UPDATE (1U << 1) @@ -348,6 +352,7 @@ enum io_uring_op { #define IORING_LINK_TIMEOUT_UPDATE (1U << 4) #define IORING_TIMEOUT_ETIME_SUCCESS (1U << 5) #define IORING_TIMEOUT_MULTISHOT (1U << 6) +#define IORING_TIMEOUT_IMMEDIATE_ARG (1U << 7) #define IORING_TIMEOUT_CLOCK_MASK (IORING_TIMEOUT_BOOTTIME | IORING_TIMEOUT_REALTIME) #define IORING_TIMEOUT_UPDATE_MASK (IORING_TIMEOUT_UPDATE | IORING_LINK_TIMEOUT_UPDATE) /* diff --git a/io_uring/timeout.c b/io_uring/timeout.c index cb61d4862fc6..a0d1db98d1fc 100644 --- a/io_uring/timeout.c +++ b/io_uring/timeout.c @@ -446,6 +446,7 @@ static int io_timeout_update(struct io_ring_ctx *ctx, __u64 user_data, int io_timeout_remove_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) { struct io_timeout_rem *tr = io_kiocb_to_cmd(req, struct io_timeout_rem); + __u64 arg; if (unlikely(req->flags & (REQ_F_FIXED_FILE | REQ_F_BUFFER_SELECT))) return -EINVAL; @@ -460,10 +461,20 @@ int io_timeout_remove_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) return -EINVAL; if (tr->flags & IORING_LINK_TIMEOUT_UPDATE) tr->ltimeout = true; - if (tr->flags & ~(IORING_TIMEOUT_UPDATE_MASK|IORING_TIMEOUT_ABS)) + if (tr->flags & ~(IORING_TIMEOUT_UPDATE_MASK | + IORING_TIMEOUT_ABS | + IORING_TIMEOUT_IMMEDIATE_ARG)) return -EINVAL; - if (get_timespec64(&tr->ts, u64_to_user_ptr(READ_ONCE(sqe->addr2)))) + + arg = READ_ONCE(sqe->addr2); + if (tr->flags & IORING_TIMEOUT_IMMEDIATE_ARG) { + if (tr->flags & IORING_TIMEOUT_ABS) + return -EINVAL; + tr->ts = ns_to_timespec64(arg); + } else if (get_timespec64(&tr->ts, u64_to_user_ptr(arg))) { return -EFAULT; + } + if (tr->ts.tv_sec < 0 || tr->ts.tv_nsec < 0) return -EINVAL; } else if (tr->flags) { @@ -518,8 +529,8 @@ static int __io_timeout_prep(struct io_kiocb *req, { struct io_timeout *timeout = io_kiocb_to_cmd(req, struct io_timeout); struct io_timeout_data *data; - unsigned flags; u32 off = READ_ONCE(sqe->off); + unsigned flags; if (sqe->buf_index || sqe->len != 1 || sqe->splice_fd_in) return -EINVAL; @@ -528,7 +539,8 @@ static int __io_timeout_prep(struct io_kiocb *req, flags = READ_ONCE(sqe->timeout_flags); if (flags & ~(IORING_TIMEOUT_ABS | IORING_TIMEOUT_CLOCK_MASK | IORING_TIMEOUT_ETIME_SUCCESS | - IORING_TIMEOUT_MULTISHOT)) + IORING_TIMEOUT_MULTISHOT | + IORING_TIMEOUT_IMMEDIATE_ARG)) return -EINVAL; /* more than one clock specified is invalid, obviously */ if (hweight32(flags & IORING_TIMEOUT_CLOCK_MASK) > 1) @@ -557,8 +569,14 @@ static int __io_timeout_prep(struct io_kiocb *req, data->req = req; data->flags = flags; - if (get_timespec64(&data->ts, u64_to_user_ptr(READ_ONCE(sqe->addr)))) + if (flags & IORING_TIMEOUT_IMMEDIATE_ARG) { + if (flags & IORING_TIMEOUT_ABS) + return -EINVAL; + data->ts = ns_to_timespec64(READ_ONCE(sqe->addr)); + } else if (get_timespec64(&data->ts, + u64_to_user_ptr(READ_ONCE(sqe->addr)))) { return -EFAULT; + } if (data->ts.tv_sec < 0 || data->ts.tv_nsec < 0) return -EINVAL; -- 2.53.0 From - Wed Feb 25 10:48:04 2026 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Return-Path: Delivered-To: hi@josie.lol Received: from witcher.mxrouting.net by witcher.mxrouting.net with LMTP id yJM+Ll7Tnmn7zSgAYBR5ng (envelope-from ) for ; Wed, 25 Feb 2026 10:47:58 +0000 Return-path: Envelope-to: hi@josie.lol Delivery-date: Wed, 25 Feb 2026 10:47:58 +0000 Received: from tor.lore.kernel.org ([172.105.105.114]) by witcher.mxrouting.net with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384 (Exim 4.98) (envelope-from ) id 1vvCQv-0000000C32i-35pV for hi@josie.lol; Wed, 25 Feb 2026 10:47:58 +0000 Received: from smtp.subspace.kernel.o--- 1.0.0 text-hyphen:~> 1.0.0|checksum:8e375be6573c795d831f08a97daaf13a956a6bd24b7b69237f81bb1d7174623b,ruby:> 0.0.0