io_uring/timeout: fix multishot updates

After update only the first shot of a multishot timeout request adheres
to the new timeout value while all subsequent retries continue to use
the old value. Don't forget to update the timeout stored in struct
io_timeout_data.

Cc: stable@vger.kernel.org
Fixes: ea97f6c8558e8 ("io_uring: add support for multishot timeouts")
Reported-by: Christian Mazakas <christian.mazakas@gmail.com>
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/e6516c3304eb654ec234cfa65c88a9579861e597.1736015288.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/io_uring/timeout.c b/io_uring/timeout.c
index 362689b17cccf7bcff333fe1f7aea54f775dfaf6..e9cec9e4dc2f26217c2598ef18f3661efec17960 100644 (file)
--- a/io_uring/timeout.c
+++ b/io_uring/timeout.c
@@ -427,10 +427,12 @@ static int io_timeout_update(struct io_ring_ctx *ctx, __u64 user_data,
 
        timeout->off = 0; /* noseq */
        data = req->async_data;
+       data->ts = *ts;
+
        list_add_tail(&timeout->list, &ctx->timeout_list);
        hrtimer_init(&data->timer, io_timeout_get_clock(data), mode);
        data->timer.function = io_timeout_fn;
-       hrtimer_start(&data->timer, timespec64_to_ktime(*ts), mode);
+       hrtimer_start(&data->timer, timespec64_to_ktime(data->ts), mode);
        return 0;
 }