diff options
| author | Pavel Begunkov <asml.silence@gmail.com> | 2020-03-22 22:23:29 +0100 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2020-03-23 02:31:27 +0100 |
| commit | 18a542ff19ad149fac9e5a36a4012e3cac7b3b3b (patch) | |
| tree | 254619a183836e5b7b72493955bf39418228c3e6 /fs/io_uring.c | |
| parent | io-wq: close cancel gap for hashed linked work (diff) | |
| download | linux-18a542ff19ad149fac9e5a36a4012e3cac7b3b3b.tar.xz linux-18a542ff19ad149fac9e5a36a4012e3cac7b3b3b.zip | |
io_uring: Fix ->data corruption on re-enqueue
work->data and work->list are shared in union. io_wq_assign_next() sets
->data if a req having a linked_timeout, but then io-wq may want to use
work->list, e.g. to do re-enqueue of a request, so corrupting ->data.
->data is not necessary, just remove it and extract linked_timeout
through @link_list.
Fixes: 60cf46ae6054 ("io-wq: hash dependent work")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'fs/io_uring.c')
| -rw-r--r-- | fs/io_uring.c | 9 |
1 files changed, 4 insertions, 5 deletions
diff --git a/fs/io_uring.c b/fs/io_uring.c index 05260ed485ad..1f61ea9c87fd 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -1567,9 +1567,10 @@ static void io_free_req(struct io_kiocb *req) static void io_link_work_cb(struct io_wq_work **workptr) { - struct io_wq_work *work = *workptr; - struct io_kiocb *link = work->data; + struct io_kiocb *req = container_of(*workptr, struct io_kiocb, work); + struct io_kiocb *link; + link = list_first_entry(&req->link_list, struct io_kiocb, link_list); io_queue_linked_timeout(link); io_wq_submit_work(workptr); } @@ -1584,10 +1585,8 @@ static void io_wq_assign_next(struct io_wq_work **workptr, struct io_kiocb *nxt) *workptr = &nxt->work; link = io_prep_linked_timeout(nxt); - if (link) { + if (link) nxt->work.func = io_link_work_cb; - nxt->work.data = link; - } } /* |