6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Josef Bacik Commit c74193430febdd120e35936dda3e5aeec3a54405 upstream. A linked timeout that fires cancels the request it is linked to, and completes with -ETIME if that worked out: ret = io_try_cancel(req->tctx, &cd, 0); ... io_req_set_res(req, ret ?: -ETIME, 0); io_try_cancel() returns 0 or an error, except for requests that are parked on ->futex_list or ->waitid_list. io_futex_cancel() and io_waitid_cancel() return the number of requests that they have cancelled, and io_try_cancel() hands it on. So the linked timeout of an IORING_OP_FUTEX_WAIT, IORING_OP_FUTEX_WAITV or IORING_OP_WAITID that it has cancelled completes with 1, each time. The waitid test of liburing checks for that 1, and has to be changed to expect -ETIME, which is what the linked timeout of any other request completes with. Fixes: f31ecf671ddc ("io_uring: add IORING_OP_WAITID support") Fixes: 194bb58c6090 ("io_uring: add support for futex wake and wait") Assisted-by: LLM Signed-off-by: Josef Bacik Link: https://patch.msgid.link/20261015-b4-io-uring-fixes-v1-42-c1556f5d7bf5@toxicpanda.com Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman --- io_uring/timeout.c | 3 +++ 1 file changed, 3 insertions(+) --- a/io_uring/timeout.c +++ b/io_uring/timeout.c @@ -317,6 +317,9 @@ static void io_req_task_link_timeout(str }; ret = io_try_cancel(req->task->io_uring, &cd, 0); + /* a number of requests for futex and waitid */ + if (ret > 0) + ret = 0; } io_req_set_res(req, ret ?: -ETIME, 0); io_req_task_complete(req, ts);