io_uring: Fix ->data corruption on re-enqueue (18a542ff) · Commits · 戴 / test

work->data and work->list are shared in union. io_wq_assign_next() sets ->data if a req having a linked_timeout, but then io-wq may want to use work->list, e.g. to do re-enqueue of a request, so corrupting ->data. ->data is not necessary, just remove it and extract linked_timeout through @link_list. Fixes: ("io-wq: hash dependent work") Signed-off-by:

Pavel Begunkov <asml.silence@gmail.com> Signed-off-by:

Jens Axboe <axboe@kernel.dk>

fs/io-wq.h

+1 −4

Original line number	Diff line number	Diff line
		@@ -63,10 +63,7 @@ static inline void wq_node_del(struct io_wq_work_list *list,
		} while (0)

		struct io_wq_work {
		union {
		struct io_wq_work_node list;
		void *data;
		};
		void (func)(struct io_wq_work *);
		struct files_struct *files;
		struct mm_struct *mm;

fs/io_uring.c

+4 −5

Original line number	Diff line number	Diff line
		@@ -1567,9 +1567,10 @@ static void io_free_req(struct io_kiocb *req)

		static void io_link_work_cb(struct io_wq_work **workptr)
		{
		struct io_wq_work work = workptr;
		struct io_kiocb *link = work->data;
		struct io_kiocb req = container_of(workptr, struct io_kiocb, work);
		struct io_kiocb *link;

		link = list_first_entry(&req->link_list, struct io_kiocb, link_list);
		io_queue_linked_timeout(link);
		io_wq_submit_work(workptr);
		}
		@@ -1584,10 +1585,8 @@ static void io_wq_assign_next(struct io_wq_work *workptr, struct io_kiocb nxt)

		*workptr = &nxt->work;
		link = io_prep_linked_timeout(nxt);
		if (link) {
		if (link)
		nxt->work.func = io_link_work_cb;
		nxt->work.data = link;
		}
		}

		/*

Admin message