Syzbot CI

Subject	io_uring: Fix hangs, lost wake ups, missed cancels and ring corner cases
Author	josef@toxicpanda.com
Date	2026-10-15 19:30:25 +0000 UTC
Version
Cc	axboe@kernel.dk io-uring@vger.kernel.org josef@toxicpanda.com teiny.work@gmail.com

Subject

io_uring: Fix hangs, lost wake ups, missed cancels and ring corner cases

Author

josef@toxicpanda.com

Date

2026-10-15 19:30:25 +0000 UTC

Version

axboe@kernel.dk io-uring@vger.kernel.org josef@toxicpanda.com teiny.work@gmail.com

Name	Content [All]
[PATCH 01/43] io_uring/waitid: own the request before clearing ->head	[Body]
[PATCH 02/43] io_uring/cmd: don't leave list poison in ->hash_node	[Body]
[PATCH 03/43] io_uring/wait: don't spin on a stuck overflow list	[Body]
[PATCH 04/43] io_uring/io-wq: don't lose the signal that ends work	[Body]
[PATCH 05/43] io_uring/io-wq: don't hide a link from cancellations	[Body]
[PATCH 06/43] io_uring: don't flood a cancelling task with task_work	[Body]
[PATCH 07/43] io_uring: don't lose the DEFER_TASKRUN wake up	[Body]
[PATCH 08/43] io_uring/cancel: rearm local work wake up before sleep	[Body]
[PATCH 09/43] io_uring/mpscq: disable preemption while pushing	[Body]
[PATCH 10/43] io_uring/io-wq: don't go to sleep on pending work	[Body]
[PATCH 11/43] io_uring/io-wq: don't strand work when a worker exits	[Body]
[PATCH 12/43] io_uring/io-wq: don't exit with a creation pending	[Body]
[PATCH 13/43] io_uring/io-wq: let cancel find picked up hashed work	[Body]
[PATCH 14/43] io_uring/poll: don't lose a cancel as io-wq arms poll	[Body]
[PATCH 15/43] io_uring: don't lose a cancel as io-wq parks a request	[Body]
[PATCH 16/43] io_uring/cancel: don't forget that the work was running	[Body]
[PATCH 17/43] io_uring/cancel: recognize "no timeout" on 32-bit	[Body]
[PATCH 18/43] io_uring/cancel: let CANCEL_ALL find parked requests	[Body]
[PATCH 19/43] io_uring: wake ring pollers for local task_work	[Body]
[PATCH 20/43] io_uring/wait: look at all CQ waiters on wake up	[Body]
[PATCH 21/43] io_uring/poll: drop stale double poll entry on rearm	[Body]
[PATCH 22/43] io_uring/futex: allocate private hash before waiting	[Body]
[PATCH 23/43] io_uring: drop the CQE cache if a refill fails	[Body]
[PATCH 24/43] io_uring: don't split 128b SQEs at the SQPOLL cap	[Body]
[PATCH 25/43] io_uring/register: don't wrap 32b CQEs when resizing	[Body]
[PATCH 26/43] io_uring/register: handle index wrap when resizing	[Body]
[PATCH 27/43] io_uring/register: keep 128b SQEs intact on resize	[Body]
[PATCH 28/43] io_uring/fdinfo: fix CQE dump of CQE32 rings	[Body]
[PATCH 29/43] io_uring/timeout: don't skip over reached sequences	[Body]
[PATCH 30/43] io_uring/timeout: keep repeat count on multishot update	[Body]
[PATCH 31/43] io_uring/timeout: use the right clock for ABS updates	[Body]
[PATCH 32/43] io_uring/wait: no early -ETIME if min_wait finds work	[Body]
[PATCH 33/43] io_uring/napi: make stale entries time out after 60s	[Body]
[PATCH 34/43] io_uring/napi: don't busy poll past an expired timeout	[Body]
[PATCH 35/43] io_uring/zcrx: fix buffer offsets in areas above 4GB	[Body]
[PATCH 36/43] io_uring/kbuf: handle index wrap in last buffer check	[Body]
[PATCH 37/43] io_uring/sqpoll: let the thread sleep on disabled rings	[Body]
[PATCH 38/43] io_uring/openclose: keep the lock in io_pipe_fixed()	[Body]
[PATCH 39/43] io_uring: don't pass restart error codes to userspace	[Body]
[PATCH 40/43] io_uring/net: don't retry recv on uncommitted buffers	[Body]
[PATCH 41/43] io_uring/timeout: no ABS update of multishot timeouts	[Body]
[PATCH 42/43] io_uring/timeout: don't end a linked timeout with 1	[Body]
[PATCH 43/43] io_uring: look up the file before queueing to io-wq	[Body]

Name

Content [All]

[PATCH 01/43] io_uring/waitid: own the request before clearing ->head

[PATCH 02/43] io_uring/cmd: don't leave list poison in ->hash_node

[PATCH 03/43] io_uring/wait: don't spin on a stuck overflow list

[PATCH 04/43] io_uring/io-wq: don't lose the signal that ends work

[PATCH 05/43] io_uring/io-wq: don't hide a link from cancellations

[PATCH 06/43] io_uring: don't flood a cancelling task with task_work

[PATCH 07/43] io_uring: don't lose the DEFER_TASKRUN wake up

[PATCH 08/43] io_uring/cancel: rearm local work wake up before sleep

[PATCH 09/43] io_uring/mpscq: disable preemption while pushing

[PATCH 10/43] io_uring/io-wq: don't go to sleep on pending work

[PATCH 11/43] io_uring/io-wq: don't strand work when a worker exits

[PATCH 12/43] io_uring/io-wq: don't exit with a creation pending

[PATCH 13/43] io_uring/io-wq: let cancel find picked up hashed work

[PATCH 14/43] io_uring/poll: don't lose a cancel as io-wq arms poll

[PATCH 15/43] io_uring: don't lose a cancel as io-wq parks a request

[PATCH 16/43] io_uring/cancel: don't forget that the work was running

[PATCH 17/43] io_uring/cancel: recognize "no timeout" on 32-bit

[PATCH 18/43] io_uring/cancel: let CANCEL_ALL find parked requests

[PATCH 19/43] io_uring: wake ring pollers for local task_work

[PATCH 20/43] io_uring/wait: look at all CQ waiters on wake up

[PATCH 21/43] io_uring/poll: drop stale double poll entry on rearm

[PATCH 22/43] io_uring/futex: allocate private hash before waiting

[PATCH 23/43] io_uring: drop the CQE cache if a refill fails

[PATCH 24/43] io_uring: don't split 128b SQEs at the SQPOLL cap

[PATCH 25/43] io_uring/register: don't wrap 32b CQEs when resizing

[PATCH 26/43] io_uring/register: handle index wrap when resizing

[PATCH 27/43] io_uring/register: keep 128b SQEs intact on resize

[PATCH 28/43] io_uring/fdinfo: fix CQE dump of CQE32 rings

[PATCH 29/43] io_uring/timeout: don't skip over reached sequences

[PATCH 30/43] io_uring/timeout: keep repeat count on multishot update

[PATCH 31/43] io_uring/timeout: use the right clock for ABS updates

[PATCH 32/43] io_uring/wait: no early -ETIME if min_wait finds work

[PATCH 33/43] io_uring/napi: make stale entries time out after 60s

[PATCH 34/43] io_uring/napi: don't busy poll past an expired timeout

[PATCH 35/43] io_uring/zcrx: fix buffer offsets in areas above 4GB

[PATCH 36/43] io_uring/kbuf: handle index wrap in last buffer check

[PATCH 37/43] io_uring/sqpoll: let the thread sleep on disabled rings

[PATCH 38/43] io_uring/openclose: keep the lock in io_pipe_fixed()

[PATCH 39/43] io_uring: don't pass restart error codes to userspace

[PATCH 40/43] io_uring/net: don't retry recv on uncommitted buffers

[PATCH 41/43] io_uring/timeout: no ABS update of multishot timeouts

[PATCH 42/43] io_uring/timeout: don't end a linked timeout with 1

[PATCH 43/43] io_uring: look up the file before queueing to io-wq

Session 2026-10-15

Passed

ID (for dev)	234c92bf-813a-47bf-9ff7-b276261f8308
Status	finished
Triaged	OK [Log] [Trajectory]
Execution Log	[Link]

Test	Base	Patched	Verdict
[KASAN] Build Base	75b36d2f2b09e3bc3294e37e693d6bf0bdf6c5e7 [Config]		passed [Log]
[KASAN] Boot test: Base	75b36d2f2b09e3bc3294e37e693d6bf0bdf6c5e7 [Config]		passed [Log]
[KASAN] Build Patched		75b36d2f2b09e3bc3294e37e693d6bf0bdf6c5e7 [Config] [patched]	passed [Log]
[KASAN] Boot test: Patched		75b36d2f2b09e3bc3294e37e693d6bf0bdf6c5e7 [Config] [patched]	passed [Log]
[KASAN] Fuzz	75b36d2f2b09e3bc3294e37e693d6bf0bdf6c5e7 [Config]	75b36d2f2b09e3bc3294e37e693d6bf0bdf6c5e7 [Config] [patched]	passed [Log] [Artifacts]

Patches (43)

Series Summary

Sessions

Session 2026-10-15