6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Josef Bacik Commit 3dc2a32cd356ee382aa4a8c7d844c53b2c0ad83b upstream. IORING_TIMEOUT_UPDATE clears ->off of the timeout it updates, to turn a timeout that waits for a number of completions into a pure one. For a multishot timeout ->off isn't a sequence though, it tells whether the number of repeats is limited: io_timeout_finish() only looks at ->repeats if ->off is set. A multishot timeout that was set up to fire N times hence fires forever once its interval has been updated. Leave ->off alone for those, they are never treated as sequence timeouts anyway. Fixes: ea97f6c8558e ("io_uring: add support for multishot timeouts") Assisted-by: LLM Signed-off-by: Josef Bacik Link: https://patch.msgid.link/20261015-b4-io-uring-fixes-v1-30-c1556f5d7bf5@toxicpanda.com Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman --- io_uring/timeout.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/io_uring/timeout.c +++ b/io_uring/timeout.c @@ -433,8 +433,10 @@ static int io_timeout_update(struct io_r if (IS_ERR(req)) return PTR_ERR(req); - timeout->off = 0; /* noseq */ data = req->async_data; + /* for a multishot request this isn't a sequence, keep the repeats */ + if (!(data->flags & IORING_TIMEOUT_MULTISHOT)) + timeout->off = 0; /* noseq */ data->ts = *ts; list_add_tail(&timeout->list, &ctx->timeout_list);