Commit 18a542ff authored by Pavel Begunkov's avatar Pavel Begunkov Committed by Jens Axboe
Browse files

io_uring: Fix ->data corruption on re-enqueue 



work->data and work->list are shared in union. io_wq_assign_next() sets
->data if a req having a linked_timeout, but then io-wq may want to use
work->list, e.g. to do re-enqueue of a request, so corrupting ->data.

->data is not necessary, just remove it and extract linked_timeout
through @link_list.

Fixes: 60cf46ae ("io-wq: hash dependent work")
Signed-off-by: default avatarPavel Begunkov <asml.silence@gmail.com>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent f2cf1149

fs/io-wq.h

+1 −4
Original line number Diff line number Diff line
@@ -63,10 +63,7 @@ static inline void wq_node_del(struct io_wq_work_list *list, 
} while (0)



struct io_wq_work {

	union {

	struct io_wq_work_node list;

		void *data;

	};

	void (*func)(struct io_wq_work **);

	struct files_struct *files;

	struct mm_struct *mm;

fs/io_uring.c

+4 −5
Original line number Diff line number Diff line
@@ -1567,9 +1567,10 @@ static void io_free_req(struct io_kiocb *req) 


static void io_link_work_cb(struct io_wq_work **workptr)

{

	struct io_wq_work *work = *workptr;

	struct io_kiocb *link = work->data;

	struct io_kiocb *req = container_of(*workptr, struct io_kiocb, work);

	struct io_kiocb *link;



	link = list_first_entry(&req->link_list, struct io_kiocb, link_list);

	io_queue_linked_timeout(link);

	io_wq_submit_work(workptr);

}
@@ -1584,10 +1585,8 @@ static void io_wq_assign_next(struct io_wq_work **workptr, struct io_kiocb *nxt) 


	*workptr = &nxt->work;

	link = io_prep_linked_timeout(nxt);

	if (link) {

	if (link)

		nxt->work.func = io_link_work_cb;

		nxt->work.data = link;

	}

}



/*