lkml.org 
[lkml]   [2020]   [Mar]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH 1/1] io_uring: Fix ->data corruption on re-enqueue
Date
work->data and work->list are shared in union. io_wq_assign_next() sets
->data if a req having a linked_timeout, but then io-wq may want to use
work->list, e.g. to do re-enqueue of a request, so corrupting ->data.

->data is not necessary, just remove it and extract linked_timeout
through @link_list.

Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
---
fs/io-wq.h | 5 +----
fs/io_uring.c | 9 ++++-----
2 files changed, 5 insertions(+), 9 deletions(-)

diff --git a/fs/io-wq.h b/fs/io-wq.h
index 298b21f4a4d2..d2a5684bf673 100644
--- a/fs/io-wq.h
+++ b/fs/io-wq.h
@@ -63,10 +63,7 @@ static inline void wq_node_del(struct io_wq_work_list *list,
} while (0)

struct io_wq_work {
- union {
- struct io_wq_work_node list;
- void *data;
- };
+ struct io_wq_work_node list;
void (*func)(struct io_wq_work **);
struct files_struct *files;
struct mm_struct *mm;
diff --git a/fs/io_uring.c b/fs/io_uring.c
index 5267e331b4a4..ce8f38aa070a 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -1567,9 +1567,10 @@ static void io_free_req(struct io_kiocb *req)

static void io_link_work_cb(struct io_wq_work **workptr)
{
- struct io_wq_work *work = *workptr;
- struct io_kiocb *link = work->data;
+ struct io_kiocb *req = container_of(*workptr, struct io_kiocb, work);
+ struct io_kiocb *link;

+ link = list_first_entry(&req->link_list, struct io_kiocb, link_list);
io_queue_linked_timeout(link);
io_wq_submit_work(workptr);
}
@@ -1584,10 +1585,8 @@ static void io_wq_assign_next(struct io_wq_work **workptr, struct io_kiocb *nxt)

*workptr = &nxt->work;
link = io_prep_linked_timeout(nxt);
- if (link) {
+ if (link)
nxt->work.func = io_link_work_cb;
- nxt->work.data = link;
- }
}

/*
--
2.24.0
\
 
 \ /
  Last update: 2020-03-22 22:25    [W:0.070 / U:0.736 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site