Commit f458dd84 authored by Pavel Begunkov's avatar Pavel Begunkov Committed by Jens Axboe
Browse files

io_uring: fix unrelated ctx reqs cancellation 



io-wq now is per-task, so cancellations now should match against
request's ctx.

Signed-off-by: default avatarPavel Begunkov <asml.silence@gmail.com>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 05962f95

fs/io_uring.c

+13 −6
Original line number Diff line number Diff line
@@ -5573,22 +5573,30 @@ static int io_timeout(struct io_kiocb *req, unsigned int issue_flags) 
	return 0;

}



struct io_cancel_data {

	struct io_ring_ctx *ctx;

	u64 user_data;

};



static bool io_cancel_cb(struct io_wq_work *work, void *data)

{

	struct io_kiocb *req = container_of(work, struct io_kiocb, work);

	struct io_cancel_data *cd = data;



	return req->user_data == (unsigned long) data;

	return req->ctx == cd->ctx && req->user_data == cd->user_data;

}



static int io_async_cancel_one(struct io_uring_task *tctx, void *sqe_addr)

static int io_async_cancel_one(struct io_uring_task *tctx, u64 user_data,

			       struct io_ring_ctx *ctx)

{

	struct io_cancel_data data = { .ctx = ctx, .user_data = user_data, };

	enum io_wq_cancel cancel_ret;

	int ret = 0;



	if (!tctx->io_wq)

	if (!tctx || !tctx->io_wq)

		return -ENOENT;



	cancel_ret = io_wq_cancel_cb(tctx->io_wq, io_cancel_cb, sqe_addr, false);

	cancel_ret = io_wq_cancel_cb(tctx->io_wq, io_cancel_cb, &data, false);

	switch (cancel_ret) {

	case IO_WQ_CANCEL_OK:

		ret = 0;
@@ -5611,8 +5619,7 @@ static void io_async_find_and_cancel(struct io_ring_ctx *ctx, 
	unsigned long flags;

	int ret;



	ret = io_async_cancel_one(req->task->io_uring,

					(void *) (unsigned long) sqe_addr);

	ret = io_async_cancel_one(req->task->io_uring, sqe_addr, ctx);

	if (ret != -ENOENT) {

		spin_lock_irqsave(&ctx->completion_lock, flags);

		goto done;