Commit 84d55dc5 authored Oct 25, 2019 by Pavel Begunkov Committed by Jens Axboe Oct 25, 2019

io_uring: Fix corrupted user_data



There is a bug, where failed linked requests are returned not with
specified @user_data, but with garbage from a kernel stack.

The reason is that io_fail_links() uses req->user_data, which is
uninitialised when called from io_queue_sqe() on fail path.

Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

parent a1f58ba4

fs/io_uring.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -2448,6 +2448,8 @@ err:
		return;
		}

		req->user_data = s->sqe->user_data;

		/*
		* If we already have a head request, queue this one for async
		* submittal once the head completes. If we don't have a head but

Admin message