[PATCH v3 7/7] io_uring: Use mutable list iterators

From: Kaitao Cheng

Date: Mon Jun 22 2026 - 00:42:07 EST


From: Kaitao Cheng <chengkaitao@xxxxxxxxxx>

The safe list iterators require callers to provide a temporary cursor
even when the cursor is only used by the iterator itself. The mutable
iterator variants keep the same removal-safe traversal semantics while
allowing those internal cursors to be hidden from the call sites.

Convert io_uring users of list and hlist safe iterators to the new
mutable helpers. Drop the now-unused temporary cursor variables where
the loop body does not inspect or reset them.

This is a mechanical cleanup with no intended change in traversal order
or list mutation behavior.

Signed-off-by: Kaitao Cheng <chengkaitao@xxxxxxxxxx>
---
io_uring/cancel.c | 6 ++----
io_uring/poll.c | 3 +--
io_uring/rw.c | 4 ++--
io_uring/timeout.c | 8 ++++----
io_uring/uring_cmd.c | 3 +--
5 files changed, 10 insertions(+), 14 deletions(-)

diff --git a/io_uring/cancel.c b/io_uring/cancel.c
index 8c6fa6f367e4..2d5b27e64582 100644
--- a/io_uring/cancel.c
+++ b/io_uring/cancel.c
@@ -358,13 +358,12 @@ bool io_cancel_remove_all(struct io_ring_ctx *ctx, struct io_uring_task *tctx,
struct hlist_head *list, bool cancel_all,
bool (*cancel)(struct io_kiocb *))
{
- struct hlist_node *tmp;
struct io_kiocb *req;
bool found = false;

lockdep_assert_held(&ctx->uring_lock);

- hlist_for_each_entry_safe(req, tmp, list, hash_node) {
+ hlist_for_each_entry_mutable(req, list, hash_node) {
if (!io_match_task_safe(req, tctx, cancel_all))
continue;
hlist_del_init(&req->hash_node);
@@ -379,12 +378,11 @@ int io_cancel_remove(struct io_ring_ctx *ctx, struct io_cancel_data *cd,
unsigned int issue_flags, struct hlist_head *list,
bool (*cancel)(struct io_kiocb *))
{
- struct hlist_node *tmp;
struct io_kiocb *req;
int nr = 0;

io_ring_submit_lock(ctx, issue_flags);
- hlist_for_each_entry_safe(req, tmp, list, hash_node) {
+ hlist_for_each_entry_mutable(req, list, hash_node) {
if (!io_cancel_req_match(req, cd))
continue;
if (cancel(req))
diff --git a/io_uring/poll.c b/io_uring/poll.c
index 0204affdc308..2b8d15fe1227 100644
--- a/io_uring/poll.c
+++ b/io_uring/poll.c
@@ -734,7 +734,6 @@ __cold bool io_poll_remove_all(struct io_ring_ctx *ctx, struct io_uring_task *tc
bool cancel_all)
{
unsigned nr_buckets = 1U << ctx->cancel_table.hash_bits;
- struct hlist_node *tmp;
struct io_kiocb *req;
bool found = false;
int i;
@@ -744,7 +743,7 @@ __cold bool io_poll_remove_all(struct io_ring_ctx *ctx, struct io_uring_task *tc
for (i = 0; i < nr_buckets; i++) {
struct io_hash_bucket *hb = &ctx->cancel_table.hbs[i];

- hlist_for_each_entry_safe(req, tmp, &hb->list, hash_node) {
+ hlist_for_each_entry_mutable(req, &hb->list, hash_node) {
if (io_match_task_safe(req, tctx, cancel_all)) {
hlist_del_init(&req->hash_node);
io_poll_cancel_req(req);
diff --git a/io_uring/rw.c b/io_uring/rw.c
index 63b6519e498c..25b896269e87 100644
--- a/io_uring/rw.c
+++ b/io_uring/rw.c
@@ -1326,7 +1326,7 @@ int io_do_iopoll(struct io_ring_ctx *ctx, bool force_nonspin)
{
unsigned int poll_flags = 0;
DEFINE_IO_COMP_BATCH(iob);
- struct io_kiocb *req, *tmp;
+ struct io_kiocb *req;
int nr_events = 0;

/*
@@ -1372,7 +1372,7 @@ int io_do_iopoll(struct io_ring_ctx *ctx, bool force_nonspin)
if (!rq_list_empty(&iob.req_list))
iob.complete(&iob);

- list_for_each_entry_safe(req, tmp, &ctx->iopoll_list, iopoll_node) {
+ list_for_each_entry_mutable(req, &ctx->iopoll_list, iopoll_node) {
/* order with io_complete_rw_iopoll(), e.g. ->result updates */
if (!smp_load_acquire(&req->iopoll_completed))
continue;
diff --git a/io_uring/timeout.c b/io_uring/timeout.c
index c4dd26cf342d..63671231cb08 100644
--- a/io_uring/timeout.c
+++ b/io_uring/timeout.c
@@ -164,14 +164,14 @@ static void io_kill_timeout(struct io_kiocb *req, struct list_head *list)

__cold void io_flush_timeouts(struct io_ring_ctx *ctx)
{
- struct io_timeout *timeout, *tmp;
+ struct io_timeout *timeout;
LIST_HEAD(list);
u32 seq;

raw_spin_lock_irq(&ctx->timeout_lock);
seq = READ_ONCE(ctx->cached_cq_tail) - atomic_read(&ctx->cq_timeouts);

- list_for_each_entry_safe(timeout, tmp, &ctx->timeout_list, list) {
+ list_for_each_entry_mutable(timeout, &ctx->timeout_list, list) {
struct io_kiocb *req = cmd_to_io_kiocb(timeout);
u32 events_needed, events_got;

@@ -733,7 +733,7 @@ static bool io_match_task(struct io_kiocb *head, struct io_uring_task *tctx,
__cold bool io_kill_timeouts(struct io_ring_ctx *ctx, struct io_uring_task *tctx,
bool cancel_all)
{
- struct io_timeout *timeout, *tmp;
+ struct io_timeout *timeout;
LIST_HEAD(list);

/*
@@ -742,7 +742,7 @@ __cold bool io_kill_timeouts(struct io_ring_ctx *ctx, struct io_uring_task *tctx
*/
spin_lock(&ctx->completion_lock);
raw_spin_lock_irq(&ctx->timeout_lock);
- list_for_each_entry_safe(timeout, tmp, &ctx->timeout_list, list) {
+ list_for_each_entry_mutable(timeout, &ctx->timeout_list, list) {
struct io_kiocb *req = cmd_to_io_kiocb(timeout);

if (io_match_task(req, tctx, cancel_all))
diff --git a/io_uring/uring_cmd.c b/io_uring/uring_cmd.c
index 7b25dcd9d05f..ce6f4fe93b20 100644
--- a/io_uring/uring_cmd.c
+++ b/io_uring/uring_cmd.c
@@ -49,13 +49,12 @@ void io_uring_cmd_cleanup(struct io_kiocb *req)
bool io_uring_try_cancel_uring_cmd(struct io_ring_ctx *ctx,
struct io_uring_task *tctx, bool cancel_all)
{
- struct hlist_node *tmp;
struct io_kiocb *req;
bool ret = false;

lockdep_assert_held(&ctx->uring_lock);

- hlist_for_each_entry_safe(req, tmp, &ctx->cancelable_uring_cmd,
+ hlist_for_each_entry_mutable(req, &ctx->cancelable_uring_cmd,
hash_node) {
struct io_uring_cmd *cmd = io_kiocb_to_cmd(req,
struct io_uring_cmd);
--
2.43.0